Get alerts attached to case APIedit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Gets all alerts attached to a case.

Requestedit

GET <kibana host>:<port>/api/cases/<case_id>/alerts

GET <kibana host>:<port>/s/<space_id>/api/cases/<case_id>/alerts

Prerequisitesedit

You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the cases you’re seeking.

Path parametersedit

<case_id>
(Required, string) The identifier for the case. To retrieve case IDs, use Find cases.
<space_id>
(Optional, string) An identifier for the space. If it is not specified, the default space is used.

Response codesedit

200
Indicates a successful call.

Examplesedit

Return all alerts attached to case 293f1bc0-74f6-11ea-b83a-553aecdb28b6:

GET api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/alerts

The API returns a JSON array listing the alerts. For example:

[
   {
      "id": "09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540",
      "index": ".internal.alerts-security.alerts-default-000001",
      "attached_at": "2022-04-13T21:35:24.602Z"
   }
]