[Cases] Add cases.observablesAdded workflow trigger - #288224
Draft
kelvtanv wants to merge 1 commit into
Draft
Conversation
Adds a new tech-preview workflow trigger that fires after one or more
observables are successfully added to a case. This covers three paths:
- Manual add (UI or API, POST /internal/cases/{id}/observables)
- Auto-extraction from alert/event attachments (when extractObservables is on)
- The cases.addObservables workflow step / Agent Builder tool
The trigger payload carries caseId, owner, and the newly-persisted
observables (id, typeKey, value, description). Only newly-added
observables are included; nothing is emitted when all submitted
observables are duplicates.
Includes:
- Common trigger definition with eventSchema, i18n docs, and examples
- Server event-bus event (emitObservablesAdded / onObservablesAdded)
- Emission in applyObservablesToCase (id-based diff) and addObservable
- Workflow event bridge subscription and server/public registration
- Approval fixture entry (schemaHash verified)
- Unit tests for event bus, trigger utils, observables, and event bridge
Closes elastic/security-team#19051
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kelvtanv
added
release_note:enhancement
backport:skip
|
🤖 Jobs for this PR can be triggered through checkboxes. 🚧
ℹ️ To trigger the CI, please tick the checkbox below 👇
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new Tech Preview workflow trigger
cases.observablesAddedthat fires after one or more observables are successfully added to a case.Closes elastic/security-team#19051
Trigger details
ID:
cases.observablesAddedStability:
tech_previewPayload
event.caseIdevent.ownersecuritySolution)event.observablesevent.observables[].idevent.observables[].typeKeyip,hash.md5)event.observables[].value1.2.3.4)event.observables[].descriptionEmission paths
applyObservablesToCasecases.addObservablesworkflow step; Agent Builder tooladdObservablePOST /internal/cases/{id}/observablesOnly newly-added observables are in the payload — existing observables that were re-submitted as duplicates are excluded via id-based diff. Nothing is emitted when every submitted observable already exists on the case.
Design note: payload includes
valueUnlike
cases.extendedFieldsUpdated(which omits field values), this trigger intentionally includesevent.observables[].value. The issue specifies this, and enrichment workflows (the primary use case — VirusTotal, MISP lookups) need the value to operate. Reviewers should be aware that workflow authors without Cases read access can observe case observable values through trigger payloads.Loop prevention
A workflow using
cases.addObservablesre-emits this trigger. The docs include a guard example withon.workflowEvents: ignore.Changes
cases/common/workflows/triggers/index.ts— newobservablesAddedTriggerCommonDefinitioncases/server/events/types.ts+event_bus.ts— new event-bus eventcases/server/client/cases/observables.ts— emit after patchCase in both write pathscases/server/client/cases/observables_trigger_utils.ts(new) — emit helpercases/server/workflows/triggers/event_bridge.ts+index.ts— bridge + registrationcases/public/workflows/triggers/observables_added.ts(new) — public definitionworkflows_extensions/test/.../approved_trigger_definitions.ts— approval fixtureTesting
node scripts/type_check --project x-pack/platform/plugins/shared/cases/tsconfig.json✅node scripts/eslint --fix✅node scripts/i18n_check --fix✅Requesting review from @elastic/workflows-eng for trigger schema approval.
🤖 Generated with Claude Code