List the case events

  • Published on Nov 28, 2024
  • 3 minute(s) read
Prev Next
Post
/v1alpha/cases/events/query

Returns the list of events attached to the specified cases.

Security
HTTP
Type bearer
Body parameters
Expand All
object
filter
object (v1ListEventsFilter)
case_ids
Array of integer

The IDs of the cases for which to retrieve the attached events.

Example[ "1", "2", "3" ]
integer (int32)
page_size
integer (int32)

The maximum number of events to retrieve per page. Default and maximum are 100. If the number of results exceeds the defined page size, use pagination to retrieve the next page of results.

Maximum100
Example50
page_token
string

The token received from a previous List the case events request. Provide this to retrieve the next page of results.

Responses
200

A successful response.

Expand All
object
events
Array of object (case_managementeventsv1AttachableEvent)

The list of attached events.

object
pretty_id
string

The pretty event ID, searchable in the Activity Log.

ExampleAB-123456
id
string

The unique identifier of the event.

case_id
integer (int32)

The ID of the case to which the event is attached.

Example28
timestamp
string (date-time)

The timestamp indicating when the event occurred.

type_details_json
object

The event data in JSON format.

Example{ "data": { "foo": "bar" } }
name
string

The name of the event as it appears in the case Events tab.

Examplecrowdstrike_alert
next_page_token
string

When a token is returned it indicates there is another page of results to retrieve. Pass this token in the page_token parameter in a subsequent List the case events request to retrieve the next page of results. If this field isn't returned it means there are no additional pages to retrieve.

400

Invalid filters in body

object
401

Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token.

object
403

You don't have permission to access this resource.

object
default

An unexpected error response.

Expand All
object
code
integer (int32)
message
string
details
Array of object (protobufAny)
object

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++.

Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo))

Example 2: Pack and unpack a message in Java.

Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) // or ... if (any.isSameTypeAs(Foo.getDefaultInstance()))

Example 3: Pack and unpack a message in Python.

foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ...

Example 4: Pack and unpack a message in Go

foo := &pb.Foo any, err := anypb.New(foo) if err != nil ... foo := &pb.Foo if err := any.UnmarshalTo(foo); err != nil

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

JSON

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example:

package google.profile; message Person

{ "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": }

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]):

{ "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" }

@type
string

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading "." is not accepted).

In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows:

  • If no scheme is provided, https is assumed.
  • An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error.
  • Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.)

Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one.

Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

property*
object additionalProperties