Get alerts attached to case API
editGet alerts attached to case API
editThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Gets all alerts attached to a case.
For the most up-to-date API details, refer to the open API specification.
Request
editGET <kibana host>:<port>/api/cases/<case_id>/alerts
GET <kibana host>:<port>/s/<space_id>/api/cases/<case_id>/alerts
Prerequisites
editYou must have read
privileges for the Cases feature in the Management,
Observability, or Security section of the
Kibana feature privileges, depending on the
owner
of the cases you’re seeking.
Path parameters
edit-
<case_id>
- (Required, string) The identifier for the case. To retrieve case IDs, use Find cases.
-
<space_id>
- (Optional, string) An identifier for the space. If it is not specified, the default space is used.
Response codes
edit-
200
- Indicates a successful call.
Examples
editReturn all alerts attached to case a8b26350-0c55-11ed-918a-2d2edf3e58bc
:
GET api/cases/a8b26350-0c55-11ed-918a-2d2edf3e58bc/alerts
The API returns a JSON array listing the alerts. For example:
[ { "id": "f6a7d0c3-d52d-432c-b2e6-447cd7fce04d", "index": ".alerts-observability.logs.alerts-default", "attached_at": "2022-07-25T20:09:40.963Z" } ]