v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Detections

Get Detection Comments

Retrieves the comments associated with the given detection ID.

get/connect/detection/{id}/comment

Path parameters

idstring required

The internal detection ID

Response

The comments have been successfully retrieved

createTimestring

The date and time that this object was created. This is a read-only field.

detectionIdstring

The detection ID to which this comment was added

idstring

The ID assigned to this object by the server. This is a read-only field.

kindstring

The kind of object. This is a read-only field.

operationstring

The operation that was applied to the object. This is a read-only field.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

valuestring

The comment text or markdown content

Example response

[
  {
    "createTime": "2024-11-14T15:03:22Z",
    "detectionId": "CwR86o8B-vS4HfrbMV5Y",
    "id": "PdFc-JIBLkNJ8-bDfz47",
    "kind": "case",
    "operation": "create",
    "updateTime": "2024-11-14T15:33:02Z",
    "userId": "socl_my_new_client",
    "value": "This detection is known to trigger FPs on the first of the month"
  }
]