The SIEM app is now a part of the Elastic Security solution. Click here to view SIEM documentation for previous releases.

› › ›

Find cases

edit

Find cases

edit

Retrieves a paginated subset of cases. By default, the first page is returned with 20 results per page.

Cases are saved objects. See Find objects API for more query parameters.

Request URL

edit

GET <kibana host>:<port>/api/cases/_find

URL query parameters

edit

All parameters are optional:

Name	Type	Description
`page`	Integer	The page number to return.
`perPage`	Integer	The number of rules to return per page.
`sortField`	String	Determines which field is used to sort the results, `createdAt` or `updatedAt`.
`sortOrder`	String	Determines the sort order, which can be `desc` or `asc`.
`status`	String	Filters the returned cases by state, which can be `open` or `closed`.
`tags`	String	Filters the returned cases by tags.
`reporters`	String	Filters the returned cases by the reporter’s `username`.

Even though the JSON case object uses created_at and updated_at fields, you must use createdAt and updatedAt fields in the URL query.

Example request

edit

Retrieves the first five cases with the phishing tag, in ascending order by last update time.

GET api/cases/_find?page=1&perPage=5&sortField=updatedAt&sortOrder=asc&tags=phishing

Response code

edit

200: Indicates a successful call.

Response payload

edit

A JSON object listing the retrieved cases.

Response example

edit

{
  "page": 1,
  "per_page": 5,
  "total": 2,
  "cases": [
    {
      "id": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2",
      "version": "WzExMCwxXQ==",
      "comments": [],
      "totalComment": 0,
      "closed_at": null,
      "closed_by": null,
      "created_at": "2020-03-29T13:03:23.533Z",
      "created_by": {
        "email": "rhustler@aol.com",
        "full_name": "Rat Hustler",
        "username": "rhustler"
      },
      "external_service": null,
      "updated_at": null,
      "updated_by": null,
      "title": "The Long Game",
      "tags": [
        "windows",
        "phishing"
      ],
      "description": "Windows 95",
      "status": "open"
    },
    {
      "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
      "version": "Wzk4LDFd",
      "comments": [],
      "totalComment": 1,
      "closed_at": null,
      "closed_by": null,
      "created_at": "2020-03-29T11:30:02.658Z",
      "created_by": {
        "email": "ahunley@imf.usa.gov",
        "full_name": "Alan Hunley",
        "username": "ahunley"
      },
      "external_service": null,
      "updated_at": "2020-03-29T12:01:50.244Z",
      "updated_by": {
        "full_name": "Classified",
        "email": "classified@hms.oo.gov.uk",
        "username": "M"
      },
      "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
      "title": "This case will self-destruct in 5 seconds",
      "status": "open",
      "tags": [
        "phishing",
        "social engineering",
        "bubblegum"
      ]
    }
  ],
  "count_open_cases": 2,
  "count_closed_cases": 0
}

« Update comment Get case »