Get all alerts for a case Technical preview

GET /api/cases/{caseId}/alerts
Api key auth Basic auth

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

Path parameters

  • caseId string Required

    The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attributes Show response attributes object
    • attached_at string(date-time)
    • id string

      The alert identifier.

    • index string

      The alert index.
  • 401 application/json

    Authorization information is missing or invalid.

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode integer
GET /api/cases/{caseId}/alerts 
curl \
 --request GET 'http://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/alerts' \
 --header "Authorization: $API_KEY"
Response examples (200) 
[
  {
    "id": "f6a7d0c3-d52d-432c-b2e6-447cd7fce04d",
    "index": ".alerts-observability.logs.alerts-default",
    "attached_at": "2022-07-25T20:09:40.963Z"
  }
]