Find All Alerts Attached to a Case

Retrieves all alerts attached to a case.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

Request URL

edit

GET <kibana host>:<port>/api/cases/<case ID>/alerts

URL parts

edit

The URL must include the case ID of the case that you are interested in retrieving the associated alerts that are attached to it. Call Find cases to retrieve case IDs.

Example request

edit

Returns all alerts attached to case 293f1bc0-74f6-11ea-b83a-553aecdb28b6:

GET api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/alerts

Response code

edit

200: Indicates a successful call.

Response payload

edit

A JSON array listing the retrieved alert comments.

Example response

edit

[
   {
      "id":"9241255e1e761ff068768671f6971bcbef869862b02188971036ed4ebba842f1",
      "index":".siem-signals-siem-estc-dev-default-000028",
      "attached_at": "2020-03-31T07:52:46.702Z",
   }
]

« Find cases by alert Actions API (for pushing cases to external systems) »