Find case activity
https://{kibana_url}
- GET /api/cases/{caseId}/user_actions/_find
- GET /s/{space_id}/api/cases/{caseId}/user_actions/_find
Refer to Spaces for more information.
Retrives a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
Path Parameters
-
caseIdstringrequired -
The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.
Query Parameters
-
pageinteger · default: 1 The page number to return.
-
perPageinteger · max: 100 · default: 20 The number of items to return. Limited to 100 items.
-
types Determines the types of user actions to return.
-
Values:
actionalertassigneesattachmentcommentconnectorcreate_casedescriptionpushedsettingsseveritystatustagstitleuser
Responses
Indicates a successful call.
-
pageinteger -
perPageinteger -
totalinteger -
userActionsobject · max: 10000 -
action -
Values:
addcreatedeletepush_to_serviceupdate -
comment_idstringrequired nullable -
created_atstringrequired -
created_byobjectrequired -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
idstringrequired -
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
payloadoneOfrequired nullable -
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
caseIdstring -
The case identifier for Swimlane connectors.
-
categorystring -
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
impactstring -
The effect an incident had on business for ServiceNow ITSM connectors.
-
issueTypestring -
The type of issue for Jira connectors.
-
issueTypesstring -
The type of incident for IBM Resilient connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
parentstring -
The key of the parent issue, when the issue type is sub-task for Jira connectors.
-
prioritystring -
The priority of the issue for Jira and ServiceNow SecOps connectors.
-
severitystring -
The severity of the incident for ServiceNow ITSM connectors.
-
severityCodestring -
The severity code of the incident for IBM Resilient connectors.
-
sourceIpbooleannullable -
Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM connectors.
-
urgencystring -
The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
-
idstring -
The identifier for the connector. To create a case without a connector, use
none. -
namestring -
The name of the connector. To create a case without a connector, use
none. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
assigneesnull · max: 10nullable -
An array containing users that are assigned to the case.
-
uidstringrequired -
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
caseIdstring -
The case identifier for Swimlane connectors.
-
categorystring -
The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
impactstring -
The effect an incident had on business for ServiceNow ITSM connectors.
-
issueTypestring -
The type of issue for Jira connectors.
-
issueTypesstring -
The type of incident for IBM Resilient connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
parentstring -
The key of the parent issue, when the issue type is sub-task for Jira connectors.
-
prioritystring -
The priority of the issue for Jira and ServiceNow SecOps connectors.
-
severitystring -
The severity of the incident for ServiceNow ITSM connectors.
-
severityCodestring -
The severity code of the incident for IBM Resilient connectors.
-
sourceIpbooleannullable -
Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
-
subcategorystring -
The subcategory of the incident for ServiceNow ITSM connectors.
-
urgencystring -
The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
-
idstring -
The identifier for the connector. To create a case without a connector, use
none. -
namestring -
The name of the connector. To create a case without a connector, use
none. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
descriptionstring -
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
settings -
An object that contains the case settings.
-
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
titlestring -
descriptionstring -
externalService -
connector_idstring -
connector_namestring -
external_idstring -
external_titlestring -
external_urlstring -
pushed_atstring -
pushed_byobjectnullable -
emailstringnullable -
full_namestringnullable -
profile_uidstring -
usernamestringnullable -
settings -
An object that contains the case settings.
-
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
titlestring -
type -
The type of action.
-
Values:
assigneescreate_casecommentconnectordescriptionpushedtagstitlestatussettingsseverity -
versionstringrequired
If the action is delete and the type is delete_case, the payload is nullable.
Authorization information is missing or invalid.
-
errorstring -
messagestring -
statusCodeinteger