You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit elastic.co/guide.

Send cases to an external system

Connectors allow you track Elastic Observability cases in external systems.

Required role

The Editor role or higher is required to create and edit connectors. To learn more, refer to Assign user roles and privileges.

If you are using an external incident management system, you can integrate Elastic Observability cases with this system using connectors. These third-party systems are supported:

  • IBM Resilient
  • Jira (including Jira Service Desk)
  • ServiceNow ITSM
  • ServiceNow SecOps
  • Swimlane
  • Webhook - Case Management

You need to create a connector to send cases, which stores the information required to interact with an external system. For each case, you can send the title, description, and comment when you choose to push the case — for the Webhook - Case Management connector, you can also send the status and severity fields.

Important

To add, modify, or delete a connector, you must have the Admin user role for the project (or a more permissive role).

After creating a connector, you can set your cases to automatically close when they are sent to an external system.

Create a connector

  1. In your Observability project, go to Cases → Settings.

  2. From the Incident management system list, select Add new connector.

  3. Select the system to send cases to: ServiceNow, Jira, IBM Resilient, Swimlane, or Webhook - Case Management.

  4. Enter your required settings. For connector configuration details, refer to:

  5. Click Save.

Edit a connector

You can create additional connectors, update existing connectors, and change the connector used to send cases to external systems.

Tip

You can also configure which connector is used for each case individually. Refer to Create and manage cases.

To change the default connector used to send cases to external systems:

  1. Go to Cases → Settings.
  2. Select the required connector from the Incident management system list.

To update an existing connector:

  1. Click Update <connector name>.
  2. Update the connector fields as required.

Sending and closing cases

To send a case to an external system, click the Push as <connector name> incident button from the individual case page. This information is not sent automatically — if you make further changes to the shared case fields, you should push the case again.

If you close cases in your external incident management system, the cases will remain open in Elastic Observability until you close them manually (the information is only sent in one direction).

To close cases when they are sent to an external system, select Automatically close cases when pushing new incident to external system from Cases → Settings.

On this page