IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Find connectors API Get case activity API »

› › ›

Get alerts attached to case API

edit

Get alerts attached to case API

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Gets all alerts attached to a case.

Request

edit

GET <kibana host>:<port>/api/cases/<case_id>/alerts

GET <kibana host>:<port>/s/<space_id>/api/cases/<case_id>/alerts

Prerequisites

edit

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you’re seeking.

Path parameters

edit

<case_id>: (Required, string) The identifier for the case. To retrieve case IDs, use Find cases.
<space_id>: (Optional, string) An identifier for the space. If it is not specified, the default space is used.

Response codes

edit

200: Indicates a successful call.

Examples

edit

Return all alerts attached to case 293f1bc0-74f6-11ea-b83a-553aecdb28b6:

GET api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/alerts

The API returns a JSON array listing the alerts. For example:

[
   {
      "id": "09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540",
      "index": ".internal.alerts-security.alerts-default-000001",
      "attached_at": "2022-04-13T21:35:24.602Z"
   }
]

« Find connectors API Get case activity API »