Get case activity
- Base URL
-
https://{kibana_url}
Refer to Spaces for more information.
Returns all user activity for a case. Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.
Authentication
Authorization: <value>
These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>
Responses
Indicates a successful call.
<array>object[]-
ownerenumrequired -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
payloadunion oneOfrequired nullable - One of:
-
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
assigneesobject[] · max items: 10nullable -
An array containing users that are assigned to the case.
-
connectorobject -
fieldsobjectnullable -
An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.
-
destIpbooleannullable -
Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
-
malwareHashbooleannullable -
Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
-
malwareUrlbooleannullable -
Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
-
ownerenum -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution
If the action is delete and the type is delete_case, the payload is nullable.