IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Get case status API Get comments API »

› › ›

Get cases by alert API

edit

Get cases by alert API

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Returns the cases associated with a specific alert.

Request

edit

GET <kibana host>:<port>/api/cases/alerts/<alert_id>

GET <kibana host>:<port>/s/<space_id>/api/cases/alerts/<alert_id>

Prerequisites

edit

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you’re seeking.

Path parameters

edit

<alert_id>: (Required, string) The alert identifier.
<space_id>: (Optional, string) An identifier for the space. If it is not specified, the default space is used.

Query parameters

edit

owner: (Optional, string or array of strings) A filter to limit the retrieved cases to a specific set of applications. Valid values are: cases, observability, and securitySolution. If this parameter is omitted, the response contains all cases that the user has access to read.

Response codes

edit

200: Indicates a successful call.

Examples

edit

Return cases associated with the alert ID 09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540:

GET api/cases/alerts/09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540

The API returns a JSON array containing the identifier and title of the cases. For example:

[
    {
        "id": "06116b80-e1c3-11ec-be9b-9b1838238ee6",
        "title":"security_case"
    }
]

« Get case status API Get comments API »