Find case activity
https://{kibana_url}
- GET /api/cases/{caseId}/user_actions/_find
- GET /s/{space_id}/api/cases/{caseId}/user_actions/_find
Refer to Spaces for more information.
Retrieves a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
Path Parameters
-
caseIdstringrequired -
The identifier for the case. To retrieve case IDs, use the search cases (
_find)API. All non-ASCII characters must be URL encoded.
Query Parameters
-
pageinteger · default: 1 The page number to return.
-
perPageinteger · max: 100 · default: 20 The number of items to return. Limited to 100 items.
-
types Determines the types of user actions to return.
-
Values:
actionalertassigneesattachmentcommentconnectorcreate_casedescriptionpushedsettingsseveritystatustagstitleuserworkflow
Responses
Indicates a successful call.
-
pageinteger -
perPageinteger -
totalinteger -
userActionsobject · max: 10000 -
action -
Values:
addcreatedeletepush_to_serviceupdate -
comment_idstringrequired nullable -
created_atstringrequired -
created_byobjectrequired -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
idstringrequired -
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
payloadoneOfrequired nullable -
commentobject -
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
caseIdstring -
The case identifier for Swimlane connectors.
-
categorystring -
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
impactstring -
The effect an incident had on business for ServiceNow ITSM connectors.
-
issueTypestring -
The type of issue for Jira connectors.
-
issueTypesstring -
The type of incident for IBM Resilient connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
parentstring -
The key of the parent issue, when the issue type is sub-task for Jira connectors.
-
prioritystring -
The priority of the issue for Jira and ServiceNow SecOps connectors.
-
severitystring -
The severity of the incident for ServiceNow ITSM connectors.
-
severityCodestring -
The severity code of the incident for IBM Resilient connectors.
-
sourceIpbooleannullable -
Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM connectors.
-
urgencystring -
The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
-
idstring -
The identifier for the connector. To create a case without a connector, use
none. -
namestring -
The name of the connector. To create a case without a connector, use
none. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
assigneesnull · max: 10nullable -
An array containing users that are assigned to the case.
-
uidstringrequired -
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
caseIdstring -
The case identifier for Swimlane connectors.
-
categorystring -
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
impactstring -
The effect an incident had on business for ServiceNow ITSM connectors.
-
issueTypestring -
The type of issue for Jira connectors.
-
issueTypesstring -
The type of incident for IBM Resilient connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
parentstring -
The key of the parent issue, when the issue type is sub-task for Jira connectors.
-
prioritystring -
The priority of the issue for Jira and ServiceNow SecOps connectors.
-
severitystring -
The severity of the incident for ServiceNow ITSM connectors.
-
severityCodestring -
The severity code of the incident for IBM Resilient connectors.
-
sourceIpbooleannullable -
Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM connectors.
-
urgencystring -
The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
-
idstring -
The identifier for the connector. To create a case without a connector, use
none. -
namestring -
The name of the connector. To create a case without a connector, use
none. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
descriptionstring -
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
settings -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration. -
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
titlestring -
descriptionstring -
externalService -
connector_idstring -
connector_namestring -
external_idstring -
external_titlestring -
external_urlstring -
pushed_atstring -
pushed_byobjectnullable -
emailstringnullable -
full_namestringnullable -
profile_uidstring -
usernamestringnullable -
settings -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration. -
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
titlestring -
originoneOf -
The context from which the workflow was triggered.
-
attachmentTypestringrequired -
The normalized registered attachment type.
-
idstringrequired -
The attachment target ID.
-
indexstring -
The Elasticsearch index the target document lives in.
-
type -
Values:
cases.attachment -
attachmentTypestringrequired -
The normalized registered attachment type.
-
countnumber -
The number of selected attachment targets.
-
idstringrequired -
The case ID.
-
type -
Values:
cases.attachments -
workflowobjectrequired -
Identifies the workflow that was run.
-
executionIdstringrequired -
The execution ID returned by the Workflows engine.
-
idstringrequired -
The workflow ID.
-
namestringrequired -
The workflow name at the time the run was triggered.
-
type -
The type of action.
-
Values:
assigneescategorycommentconnectorcreate_casecustomFieldsdelete_casedescriptionextended_fieldsobservablespushedsettingsseveritystatustagstitleworkflow -
versionstringrequired
If the action is delete and the type is delete_case, the payload is nullable.
The payload for a workflow user action, recorded when a user runs a workflow from a case.
Authorization information is missing or invalid.
-
errorstring -
messagestring -
statusCodeinteger