Get cases for an alert

Base URL
https://{kibana_url}
Auth

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you're seeking.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

alertId string required

An identifier for the alert.

Query parameters

owner union oneOf

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

Values: cases observability securitySolution

Responses

Indicates a successful call.

application/json
<array> object[] · max items: 10000
createdAt string · format: date-time required

When the case was created.

description string required

The case description.

id string required

The case identifier.

status enum required

The status of the case.

Values: closed in-progress open
title string required

The case title.

totals object required

Counts of alerts, events, and user comments attached to a case.

alerts integer required

Number of alert attachments on the case.

events integer required

Number of event attachments on the case.

userComments integer required

Number of user comment attachments on the case.

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}