Find cases by alert
editFind cases by alert
editUses an alert ID (alert id
) to retrieve the case IDs of any cases the alert is attached to.
The case ID is identical to the case’s saved object ID.
Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl
or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.
Request URL
editGET <kibana host>:<port>/api/cases/alerts/<alert id>
URL parts
editThe URL must include the alert ID, which is used to retrieve any cases the alert is attached to.
URL query parameters
editName | Type | Description | Required |
---|---|---|---|
|
String or String[] |
A filter to limit the retrieved case IDs to a specific set of applications. If you omit this parameter, the response will contain every case ID that the user has |
No |
Example request
editReturns case IDs with the alert ID 293f1bc0-74f6-11ea-b83a-553aecdb28b6
attached to them:
GET api/cases/alerts/293f1bc0-74f6-11ea-b83a-553aecdb28b6
Response code
edit-
200
- Indicates a successful call.