Function attach_alerts 

pub async fn attach_alerts(
    t: &Transport,
    case_id: &str,
    alert_ids: &[String],
    indices: &[String],
    rule_id: &str,
    rule_name: &str,
) -> Result<Case>

Attach alerts as one comment of type alert. All alerts in one call share a rule (the API takes one rule object per comment); the caller groups by rule. alert_ids and indices are parallel arrays.