intial case api docs

docs/en/siem/cases-api-add-comment.asciidoc

@@ -0,0 +1,65 @@
+[[cases-api-add-comment]]
+=== Add comment
+
+Adds a comment to an existing case.
+
+==== Request URL
+
+`POST /api/cases/<case ID>/comment`
+
+===== URL parts
+
+The URL must include the `case ID` of the case to which you are adding a 
+comment.
+
+==== Request body
+
+A JSON object with a `comment` field:
+
+[width="100%",options="header"]
+|==============================================
+|Name |Type |Description |Required
+
+|`comment` |String |The case's new comment. |Yes
+|==============================================
+
+===== Example request
+
+Adds a comment to case ID `c2ffcea0-57d0-11ea-95da-cb9f4a010e31`:
+
+[source,sh]
+--------------------------------------------------
+POST api/cases/c2ffcea0-57d0-11ea-95da-cb9f4a010e31/comment
+{
+  "comment": "That is nothing - Ethan Hunt answered a targeted social media 
+  campaign promoting phishy pension schemes to IMF operatives."
+}
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.
+
+==== Response payload
+
+A JSON object that includes the user who created the comment and the comment's
+ID, version, and creation time.
+
+===== Example response
+
+[source,json]
+--------------------------------------------------
+{
+  "comment_id": "f118e4a0-57e1-11ea-95da-cb9f4a010e31",
+  "version": "WzM1LDFd",
+  "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
+  "created_at": "2020-02-25T15:17:31.057Z",
+  "created_by": {
+    "full_name": "Ms Moneypenny",
+    "username": "moneypenny"
+  },
+  "updated_at": "2020-02-25T15:17:31.057Z"
+}
+--------------------------------------------------

docs/en/siem/cases-api-create.asciidoc

@@ -0,0 +1,80 @@
+[[cases-api-create]]
+=== Create case
+
+Creates a new case.
+
+==== Request URL
+
+`POST /api/cases`
+
+==== Request body
+
+A JSON object with these fields:
+
+[width="100%",options="header"]
+|==============================================
+|Name |Type |Description |Required
+
+|`title` |String |The case's title. |Yes
+|`description` |String |The case's description. |Yes
+|`state` |String a|Indicates whether the case is open or closed. Valid values 
+are:
+
+* `open`
+* `closed`
+
+|No, defaults to `open`.
+|`tags` |String[] |String array containing words and phrases that help categorize 
+cases. |No, defaults to an empty array.
+|==============================================
+
+===== Example request
+
+[source,sh]
+--------------------------------------------------
+POST api/cases
+{
+  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
+  "title": "This case will self-destruct in 5 seconds",
+  "state": "open",
+  "tags": [
+    "phishing",
+    "social engineering"
+  ]
+}
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.
+
+==== Response payload
+
+A JSON object that includes the user who created the case and the case's ID,
+version, and creation time.
+
+===== Example response
+
+[source,json]
+--------------------------------------------------
+{
+  "case_id": "c2ffcea0-57d0-11ea-95da-cb9f4a010e31",
+  "version": "WzI4LDFd",
+  "comments": [],
+  "created_at": "2020-02-25T13:14:32.264Z",
+  "created_by": {
+    "full_name": "Alan Hunley",
+    "username": "ahunley"
+  },
+  "updated_at": "2020-02-25T13:14:32.264Z",
+  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
+  "title": "This case will self-destruct in 5 seconds",
+  "state": "open",
+  "tags": [
+    "phishing",
+    "social engineering"
+  ]
+}
+--------------------------------------------------

docs/en/siem/cases-api-delete-case.asciidoc

@@ -0,0 +1,27 @@
+[[cases-api-delete-case]]
+=== Delete case
+
+Deletes the specified case and all associated comments.
+
+==== Request URL
+
+`DELETE /api/cases/<case ID>`
+
+===== URL parts
+
+The URL must include the `case ID` of the case you are deleting. 
+
+===== Example request
+
+Deletes case ID `0a0fa050-20e4-11ea-8f80-690fedc74682`:
+
+[source,sh]
+--------------------------------------------------
+DELETE api/cases/0a0fa050-20e4-11ea-8f80-690fedc74682
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.

docs/en/siem/cases-api-delete-comment.asciidoc

@@ -0,0 +1,27 @@
+[[cases-api-delete-comment]]
+=== Delete comment
+
+Deletes the specified comment.
+
+==== Request URL
+
+`DELETE /api/cases/comments/<comment ID>`
+
+===== URL parts
+
+The URL must include the `comment ID` of the comment you are deleting. 
+
+===== Example request
+
+Deletes comment ID `669364c0-2174-11ea-87ed-69e2fb63d9ed`:
+
+[source,sh]
+--------------------------------------------------
+DELETE api/cases/comments/669364c0-2174-11ea-87ed-69e2fb63d9ed
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.

docs/en/siem/cases-api-get-all-cases.asciidoc

@@ -0,0 +1,108 @@
+[[cases-api-get-all-cases]]
+=== Get all cases
+
+Retrieves a paginated subset of cases. By default, the first page is returned 
+with 20 results per page.
+
+==== Request URL
+
+`GET /api/cases`
+
+===== URL query parameters
+
+All parameters are optional:
+
+[width="100%",options="header"]
+|==============================================
+|Name |Type |Description
+
+|`page` |Integer |The page number to return.
+
+|`perPage` |Integer |The number of rules to return per page.
+
+|`sortField` |String |Determines which field is used to sort the results,
+`createdAt` or `updatedAt`.
+
+|`sortOrder` |String |Determines the sort order, which can be `desc` or `asc`.
+
+|`filter` |String a|Filters the returned results according to the value of the 
+specified field, using the `case-workflow.attributes.<field name>:<field value>` syntax, where `<field name>` can be:
+
+* `state`
+* `tags`
+
+|==============================================
+
+NOTE: Even though the JSON case object uses `created_at` and `updated_at`
+fields, you must use `createdAt` and `updatedAt` fields in the URL
+query.
+
+===== Example request
+
+Retrieves the first five cases with the `phishing` tag, in ascending order by 
+last update time.
+
+[source,sh]
+--------------------------------------------------
+GET api/cases?page=1&perPage=5&sortField=updatedAt&sortOrder=asc&filter=case-workflow.attributes.tags:phishing
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.
+
+==== Response payload
+
+A JSON object listing all cases.
+
+===== Response example
+
+[source,json]
+--------------------------------------------------
+{
+  "page": 1,
+  "per_page": 5,
+  "total": 2,
+  "cases": [
+    {
+      "case_id": "c2ffcea0-57d0-11ea-95da-cb9f4a010e31",
+      "version": "WzQ2LDFd",
+      "comments": [],
+      "created_at": "2020-02-25T13:14:32.264Z",
+      "created_by": {
+        "full_name": "Alan Hunley",
+        "username": "ahunley"
+      },
+      "updated_at": "2020-02-26T15:46:48.716Z",
+      "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
+      "title": "This case will self-destruct in 5 seconds",
+      "state": "open",
+      "tags": [
+        "phishing",
+        "social engineering",
+        "bubblegum"
+      ]
+    },
+    {
+      "case_id": "e1c61e40-58af-11ea-910e-c9f06dd752a6",
+      "version": "WzUyLDFd",
+      "comments": [],
+      "created_at": "2020-02-26T15:51:41.669Z",
+      "created_by": {
+        "full_name": "Rat Hustler",
+        "username": "rhustler"
+      },
+      "updated_at": "2020-02-26T16:21:16.693Z",
+      "title": "The Long Game",
+      "description": "Windows 95",
+      "tags": [
+        "windows",
+        "phishing"
+      ],
+      "state": "open"
+    }
+  ]
+}
+--------------------------------------------------

docs/en/siem/cases-api-get-case-comments.asciidoc

@@ -0,0 +1,67 @@
+[[cases-api-get-all-case-comments]]
+=== Get all case comments
+
+Returns a paginated subset of comments for the specified case.
+
+==== Request URL
+
+`GET /api/cases/<case ID>/comments`
+
+===== URL parts
+
+The URL must include the `case ID` of the case for which you are retrieving 
+comments.
+
+===== Example request
+
+Gets all comments for case ID `c2ffcea0-57d0-11ea-95da-cb9f4a010e31`:
+
+[source,sh]
+--------------------------------------------------
+GET api/cases/c2ffcea0-57d0-11ea-95da-cb9f4a010e31/comments
+--------------------------------------------------
+// KIBANA
+
+==== Response code
+
+`200`:: 
+   Indicates a successful call.
+
+==== Response payload
+
+A JSON object listing comments for the specified case.
+
+===== Response example
+
+[source,json]
+--------------------------------------------------
+{
+  "page": 1,
+  "per_page": 20,
+  "total": 2,
+  "comments": [
+    {
+      "comment_id": "0a846810-5940-11ea-bad4-61e6383623ca",
+      "version": "WzE1LDFd",
+      "comment": "Start operation bubblegum immediately! And chew fast!",
+      "created_at": "2020-02-27T09:03:37.554Z",
+      "created_by": {
+        "full_name": "Classified",
+        "username": "M"
+      },
+      "updated_at": "2020-02-27T09:03:37.554Z"
+    },
+    {
+      "comment_id": "f118e4a0-57e1-11ea-95da-cb9f4a010e31",
+      "version": "WzE3LDFd",
+      "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives. Even worse, he likes baked beans.",
+      "created_at": "2020-02-25T15:17:31.057Z",
+      "created_by": {
+        "full_name": "Ms Moneypenny",
+        "username": "moneypenny"
+      },
+      "updated_at": "2020-02-27T09:35:21.019Z"
+    }
+  ]
+}
+--------------------------------------------------