Cases
APIs for managing cases
This endpoint retrieves a list of cases that match the specified filter criteria. It supports filtering by case_id, case_domain, status_progress, severity, and creation_time, along with sorting and pagination.
Request Body:
request_data: Object containing filter criteriafilters: Array of filter objectsfield: String (enum: 'case_id', 'case_domain', 'severity', 'creation_time', 'status_progress')operator: String (enum: 'in', 'gte', 'lte')value: Array of integers/strings or single integer
search_from: Integer (default: 0) - Starting index for paginationsearch_to: Integer (default: 100) - Ending index for paginationsort: Object for sorting resultsfield: String (enum: 'creation_time', 'severity', 'case_id')keyword: String (enum: 'asc', 'desc') - Sort order
Successful response with cases
Bad request
Unauthorized access
Internal server error
POST /public_api/v1/case/search HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 153
{
"request_data": {
"filters": [
{
"field": "case_id",
"operator": "in",
"value": [
1
]
}
],
"search_from": 0,
"search_to": 100,
"sort": {
"field": "case_id",
"keyword": "asc"
}
}
}{
"reply": {
"TOTAL_COUNT": 1,
"FILTER_COUNT": 1,
"DATA": [
{
"case_id": "123",
"creation_time": "2024-02-26T12:34:56Z",
"owner": "CWP",
"case_domain": "SECURITY",
"auto_resolve_case": false,
"custom_fields": {
"priority": "High",
"incident_id": "INC98765"
},
"status_progress": "UNDER_INVESTIGATION",
"resolve_reason": "RESOLVED_OTHER",
"resolve_comment": "Case has been marked as a false positive.",
"last_modified": 1708950896000,
"score": 85,
"severity": "HIGH",
"description": "Unauthorized access detected",
"scoring_type": "Risk-Based",
"assigned_to": "U56789",
"assigned_to_name": "JaneSmith",
"is_cloud": true,
"is_automated": false,
"issues": [
"123"
],
"assets": [
"6f1d9b9361f8a6964bf3e79e6667e5fe"
],
"artifacts": [
"12345"
]
}
]
}
}Update an existing case in the system. Users can only update one case at a time.
At least one of the following fields is mandatory:
case_id
Numeric ID of the case to update
Case updated successfully
No content
Bad request
Unauthorized access
Internal server error
POST /public_api/v1/case/update/{case-id} HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 159
{
"request_data": {
"update_data": {
"status_progress": "RESOLVED",
"resolve_reason": "RESOLVED_OTHER",
"resolve_comment": "Case has been marked as a false positive."
}
}
}No content
This endpoint retrieves the artifacts for a given case_id
Numeric ID of the case
Successful response with cases
Bad request
Unauthorized access
Internal server error
GET /public_api/v1/case/artifacts/{case-id} HTTP/1.1
Host: api-{{fqdn}}
Accept: */*
{
"reply": {
"TOTAL_COUNT": 1,
"FILTER_COUNT": 1,
"DATA": [
{
"case_id": 1234,
"network_artifacts": {
"DATA": [
{
"artifact_id": "A12345",
"file_name": "test",
"file_sha256": "1111",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "BENIGN",
"is_malicous": true,
"is_manual": false,
"is_process": false,
"low_confidence": false,
"type": "HASH"
}
],
"TOTAL_COUNT": 10
},
"file_artifacts": {
"DATA": [
{
"artifact_id": "A12345",
"file_name": "test",
"file_sha256": "1111",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "BENIGN",
"is_malicous": true,
"is_manual": false,
"is_process": false,
"low_confidence": false,
"type": "HASH"
}
],
"TOTAL_COUNT": 10
}
}
]
}
}Get the War Room entries for a specific case or alert. You can filter by timestamp, ID, and tags. You can also choose which type of entries you want to retrieve (notes, chat, attachments...). The response depends on what type of entry you choose to retrieve.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
The ID of the case or alert you want to get the War Room entries of. For a case ID, prepend "CASE-" to the case ID.
For example, if the case ID is 3, the value of id should be CASE-3.
For alert IDs, just put the ID. For example, if the alert ID is 3, the value of id should be 3.
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/entries/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 126
{
"id": "text",
"filter": {
"firstID": "text",
"lastID": "text",
"pagesize": 1,
"fromTime": "text",
"categories": [
"tags"
],
"tags": [
"text"
]
}
}{
"total": 2,
"data": [
{
"id": "f1db36f0-d00f-4470-818f-c6911d392f76@INCIDENT-1",
"modified": "2025-01-02T10:17:57.738577545Z",
"created": "2025-01-01T13:15:48.302901Z",
"user": "",
"parentContent": "!markAsNote entryIDs=\"1\"",
"contents": "done",
"format": "text",
"investigationId": "INCIDENT-1",
"category": "artifact",
"isTodo": false,
"tags": [
"john100"
]
},
{
"id": "0d6a01a4-58b5-4121-8db7-c371e38284db@INCIDENT-1",
"modified": "2025-01-02T10:22:26.6396269Z",
"created": "2025-01-02T09:11:51.747644Z",
"user": "",
"contents": "'aaaaaa'",
"format": "text",
"investigationId": "INCIDENT-1",
"category": "artifact",
"isTodo": false,
"tags": [
"john200"
]
}
]
}Add an entry to the cases or alert War Room, including data. Note: This endpoint only adds entries to existing War Rooms; it does not create them. Ensure that the War Room already exists before making this request.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
The ID of the case or issue for which you want to add a War Room entry. For a case ID, prepend "CASE-" to the case ID.
For example, if the case ID is 3, the value of id should be CASE-3.
For alert IDs, just put the ID. For example, if the alert ID is 3, the value of id should be 3.
The data you want to add or the command you want to run in the War Room.
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/entries/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 37
{
"id": "1",
"data": "!Print value=1000"
}{
"id": "b30fadee-53e3-4859-8c79-fa328ba7b4fd@1",
"version": 1,
"cacheVersn": 0,
"modified": "2025-01-29T13:48:41.591466357Z",
"sizeInBytes": 0,
"type": 1,
"created": "2025-01-29T13:48:41.591444333Z",
"incidentCreationTime": "2025-01-29T13:48:41.591444333Z",
"investigationCreationTime": "2024-12-25T14:43:07.697Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "",
"errorSource": "",
"contents": "!Print value=1",
"format": "text",
"investigationId": "1",
"file": "",
"fileID": "",
"parentId": "",
"pinned": false,
"fileMetadata": null,
"parentContent": null,
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "chat",
"note": false,
"isTodo": false,
"tags": null,
"tagsRaw": null,
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 14,
"brand": "none",
"InstanceID": "",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}Last updated
Was this helpful?