IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Get case
editGet case
editReturns the specified case.
Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl
or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.
Request URL
editGET <kibana host>:<port>/api/cases/<case ID>
URL parts
editThe URL must include the case ID
of the case you are retrieving. Call
Find cases to retrieve case IDs.
URL query parameters
editName | Type | Description | Required |
---|---|---|---|
|
Boolean |
Determines whether case comments are returned. |
No, defaults to |
Example request
editReturns case ID a18b38a0-71b0-11ea-a0b2-c51ea50a58e2
without comments:
GET api/cases/a18b38a0-71b0-11ea-a0b2-c51ea50a58e2?includeComments=false
Response code
edit-
200
- Indicates a successful call.
Response payload
editThe requested case JSON object.
Response example
edit{ "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2", "version": "Wzk4LDFd", "comments": [], "totalComment": 0, "closed_at": null, "closed_by": null, "created_at": "2020-03-29T11:30:02.658Z", "created_by": { "email": "ahunley@imf.usa.gov", "full_name": "Alan Hunley", "username": "ahunley" }, "external_service": null, "updated_at": "2020-03-29T12:01:50.244Z", "updated_by": { "full_name": "Classified", "email": "classified@hms.oo.gov.uk", "username": "M" }, "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!", "title": "This case will self-destruct in 5 seconds", "status": "open", "connector": { "id": "131d4448-abe0-4789-939d-8ef60680b498", "name": "My connector", "type": ".jira", "fields": { "issueType": "10006", "priority": "High", } }, "settings": { "syncAlerts": true }, "owner": "securitySolution", "tags": [ "phishing", "social engineering", "bubblegum" ] }