Search cases

Server: https://{kibana_url}

GET /api/cases/_find
GET /s/{space_id}/api/cases/_find

Refer to Spaces for more information.

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

Query Parameters

assignees union string | [] string: Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.; One of: string or string[]
category union string | [] string: Filters the returned cases by category.; One of: string or string[]
defaultSearchOperator string · default: OR: he default operator to use for the simple_query_string.
from string: Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.
owner union oneOf: A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.; Values: cases observability securitySolution
page integer · default: 1: The page number to return.
perPage integer · max: 100 · default: 20: The number of items to return. Limited to 100 items.
reporters union string | [] string: Filters the returned cases by the user name of the reporter.; One of: string or string[]
search string: An Elasticsearch simple_query_string query that filters the objects in the response.
searchFields union oneOf: The fields to perform the simple_query_string parsed query against.; Values: description title
severity enum: The severity of the case.; Values: critical high low medium
sortField enum · default: createdAt: Determines which field is used to sort the results.; Values: createdAt updatedAt closedAt title category status severity
sortOrder enum · default: desc: Determines the sort order.; Values: asc desc
status enum: Filters the returned cases by state.; Values: closed in-progress open
tags union string | [] string: Filters the returned cases by tags.; One of: string or string[]
to string: Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.

Responses

Indicates a successful call.

application/json

Authorization information is missing or invalid.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/cases/_find

curl Shell

curl -X GET "https://{kibana_url}/api/cases/_find"

Response

{
  "cases": [
    {
      "assignees": [],
      "category": "null",
      "closed_at": "null",
      "closed_by": "null",
      "comments": [],
      "connector": {
        "fields": "null",
        "id": "none",
        "name": "none",
        "type": ".none"
      },
      "created_at": "2023-10-12T00:16:36.371Z",
      "created_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "customFields": [
        {
          "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
          "type": "text",
          "value": "My field value"
        },
        {
          "key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
          "type": "toggle",
          "value": "null"
        }
      ],
      "description": "Case description",
      "duration": "null",
      "external_service": "null",
      "id": "abed3a70-71bd-11ea-a0b2-c51ea50a58e2",
      "incremental_id": 1,
      "observables": [],
      "owner": "cases",
      "settings": {
        "extractObservables": false,
        "syncAlerts": true
      },
      "severity": "low",
      "status": "open",
      "tags": [
        "tag-1"
      ],
      "title": "Case title",
      "total_observables": 0,
      "totalAlerts": 0,
      "totalComment": 1,
      "totalEvents": 0,
      "updated_at": "2023-10-12T00:27:58.162Z",
      "updated_by": {
        "email": "null",
        "full_name": "null",
        "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
        "username": "elastic"
      },
      "version": "WzExMCwxXQ=="
    }
  ],
  "count_closed_cases": 0,
  "count_in_progress_cases": 0,
  "count_open_cases": 1,
  "page": 1,
  "per_page": 5,
  "total": 1
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

Query Parameters { assignees , category , defaultSearchOperator , from , owner , page , perPage , reporters , search , searchFields , severity , sortField , sortOrder , status , tags , to , }

Responses

Query Parameters