Get cases for an alert

Base URL: https://{kibana_url}

GET /api/cases/alerts/{alertId}

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Responses

Indicates a successful call.

application/json

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/cases/alerts/09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/cases/alerts/09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

[
  {
    "createdAt": "2020-02-19T23:06:33.798Z",
    "description": "Investigating suspicious activity",
    "id": "06116b80-e1c3-11ec-be9b-9b1838238ee6",
    "status": "open",
    "title": "security_case",
    "totals": {
      "alerts": 1,
      "events": 0,
      "userComments": 0
    }
  }
]

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}