Get all alerts for a case | Kibana API documentation (v9)

Get all alerts for a case Technical preview

GET /api/cases/{caseId}/alerts

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

Path parameters

caseId string Required

The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Responses

200 application/json

Indicates a successful call.
Hide response attributes Show response attributes object
- attached_at string(date-time)
- id string
  
  The alert identifier.
- index string
  
  The alert index.
401 application/json

Authorization information is missing or invalid.
Hide response attributes Show response attributes object
- error string
- message string
- statusCode integer

GET /api/cases/{caseId}/alerts

curl \
 --request GET 'http://localhost:5622/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/alerts' \
 --header "Authorization: $API_KEY"

Response examples (200)

[
  {
    "id": "f6a7d0c3-d52d-432c-b2e6-447cd7fce04d",
    "index": ".alerts-observability.logs.alerts-default",
    "attached_at": "2022-07-25T20:09:40.963Z"
  }
]

Response examples (401)

{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}