Find case activity

Base URL
https://{kibana_url}
Auth

Retrieves a paginated list of user activity for a case. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're seeking.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

caseId string required

The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded.

Example: 9c235210-6834-11ea-a78c-6ffb38a34414

Query parameters

page integer · default: 1

The page number to return.

perPage integer · max: 100 · default: 20

The number of items to return. Limited to 100 items.

sortOrder enum · default: desc

Determines the sort order.

Values: asc desc
types enum[]

Determines the types of user actions to return.

Values: action alert assignees attachment bulkAttachments comment connector create_case description pushed settings severity status tags title user workflow

Responses

Indicates a successful call.

application/json
page integer
perPage integer
total integer
userActions object[] · max items: 10000
action enum required
Values: add create delete push_to_service update
comment_id string required nullable
created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
id string required
owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
payload union oneOf required nullable
One of:
comment object
alertId union string | string[]
index union string | string[]
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
rule object
id string nullable

The rule identifier.

name string nullable

The rule name.

type enum
Values: alert
type enum required

The type of action.

Values: assignees bulkAttachments category comment connector create_case customFields delete_case description extended_fields observables pushed settings severity status tags title workflow
version string required

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}