> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/cases.md).
# Cases
APIs for managing cases
## Retrieve Cases based on filters
> This endpoint retrieves a list of cases that match the specified filter criteria. It supports filtering by \`case\_id\`, \`case\_domain\`, \`status\_progress\`, \`severity\`, and \`creation\_time\`, along with sorting and pagination.\
> \
> Request Body:\
> \- \`request\_data\`: Object containing filter criteria\
> \- \`filters\`: Array of filter objects\
> \- \`field\`: String (enum: 'case\_id', 'case\_domain', 'severity', 'creation\_time', 'status\_progress')\
> \- \`operator\`: String (enum: 'in', 'gte', 'lte')\
> \- \`value\`: Array of integers/strings or single integer\
> \- \`search\_from\`: Integer (default: 0) - Starting index for pagination\
> \- \`search\_to\`: Integer (default: 100) - Ending index for pagination\
> \- \`sort\`: Object for sorting results\
> \- \`field\`: String (enum: 'creation\_time', 'severity', 'case\_id')\
> \- \`keyword\`: String (enum: 'asc', 'desc') - Sort order
```json
{"openapi":"3.0.0","info":{"title":"Cortex AgentiX APIs","version":"Cortex AgentiX"},"tags":[{"name":"Cases","description":"APIs for managing cases"}],"servers":[{"url":"https://api-{{fqdn}}"}],"paths":{"/public_api/v1/case/search":{"post":{"tags":["Cases"],"summary":"Retrieve Cases based on filters","description":"This endpoint retrieves a list of cases that match the specified filter criteria. It supports filtering by `case_id`, `case_domain`, `status_progress`, `severity`, and `creation_time`, along with sorting and pagination.\n\nRequest Body:\n- `request_data`: Object containing filter criteria\n - `filters`: Array of filter objects\n - `field`: String (enum: 'case_id', 'case_domain', 'severity', 'creation_time', 'status_progress')\n - `operator`: String (enum: 'in', 'gte', 'lte')\n - `value`: Array of integers/strings or single integer\n- `search_from`: Integer (default: 0) - Starting index for pagination\n- `search_to`: Integer (default: 100) - Ending index for pagination\n- `sort`: Object for sorting results\n - `field`: String (enum: 'creation_time', 'severity', 'case_id')\n - `keyword`: String (enum: 'asc', 'desc') - Sort order","operationId":"getCases","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","items":{"type":"object","properties":{"field":{"type":"string","enum":["case_id","case_domain","severity","creation_time","status_progress"],"description":"Specifies the field to filter cases by."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"Comparison operator to use with the filter."},"value":{"description":"Value(s) for filtering the cases.","oneOf":[{"type":"array","items":{"type":"integer"}},{"type":"array","items":{"type":"string"}},{"type":"integer"}]}}}},"search_from":{"type":"integer","description":"Starting index for pagination.","default":0},"search_to":{"type":"integer","description":"Ending index for pagination.","default":100},"sort":{"type":"object","properties":{"field":{"type":"string","enum":["case_id","severity","creation_time"]},"keyword":{"type":"string","enum":["asc","desc"],"description":"Sort order (ascending or descending)."}}}}}}}}}},"responses":{"200":{"description":"Successful response with cases","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"TOTAL_COUNT":{"type":"integer"},"FILTER_COUNT":{"type":"integer"},"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Case"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"Case":{"type":"object","properties":{"case_id":{"type":"string","description":"Unique identifier for the case"},"creation_time":{"type":"string","description":"Timestamp of case creation","format":"date-time"},"owner":{"type":"string","description":"Owner of the case"},"case_domain":{"type":"string","description":"Domain associated with the case"},"auto_resolve_case":{"type":"boolean","description":"Indicates if the case is auto-resolved"},"custom_fields":{"type":"object","description":"Custom fields for additional metadata"},"status_progress":{"type":"string","enum":["NEW","UNDER_INVESTIGATION","RESOLVED"]},"resolve_reason":{"type":"string","enum":["RESOLVED_KNOWN_ISSUE","RESOLVED_DUPLICATE","RESOLVED_FALSE_POSITIVE","RESOLVED_OTHER","RESOLVED_TRUE_POSITIVE","RESOLVED_SECURITY_TESTING","RESOLVED_FIXED","RESOLVED_DISMISSED"]},"resolve_comment":{"type":"string"},"last_modified":{"type":"integer","description":"Timestamp of last modification","format":"int64"},"score":{"type":"integer","description":"Score assigned to the case","format":"int32"},"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"description":{"type":"string","description":"Detailed description of the case"},"scoring_type":{"type":"string","description":"Scoring type applied to the case"},"assigned_to":{"type":"string","description":"ID of the assigned user"},"assigned_to_name":{"type":"string","description":"Name of the assigned user"},"is_cloud":{"type":"boolean","description":"Indicates if the case is cloud-based"},"is_automated":{"type":"boolean","description":"Indicates if the case is automated"},"issues":{"type":"array","items":{"type":"string","description":"Unique identifier for the issue"}},"assets":{"type":"array","items":{"type":"string","description":"Unique identifier for the asset"}},"artifacts":{"type":"array","items":{"type":"string","description":"Unique identifier for the artifact"}}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}}
```
## Update existing case
> Update an existing case in the system. \*\*Users can only update one case at a time.\*\* \
> \- At least one of the following fields is \*\*mandatory\*\*: \
> \- case\_id
```json
{"openapi":"3.0.0","info":{"title":"Cortex AgentiX APIs","version":"Cortex AgentiX"},"tags":[{"name":"Cases","description":"APIs for managing cases"}],"servers":[{"url":"https://api-{{fqdn}}"}],"paths":{"/public_api/v1/case/update/{case-id}":{"post":{"tags":["Cases"],"summary":"Update existing case","description":"Update an existing case in the system. **Users can only update one case at a time.** \n- At least one of the following fields is **mandatory**: \n - case_id \n","operationId":"updateCase","parameters":[{"name":"case-id","in":"path","description":"Numeric ID of the case to update","required":true,"schema":{"type":"integer"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"update_data":{"$ref":"#/components/schemas/UpdateCase"}}}}}}}},"responses":{"204":{"description":"Case updated successfully"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"UpdateCase":{"type":"object","properties":{"status_progress":{"type":"string","enum":["NEW","UNDER_INVESTIGATION","RESOLVED"]},"resolve_reason":{"type":"string","enum":["RESOLVED_KNOWN_ISSUE","RESOLVED_DUPLICATE","RESOLVED_FALSE_POSITIVE","RESOLVED_OTHER","RESOLVED_TRUE_POSITIVE","RESOLVED_SECURITY_TESTING","RESOLVED_FIXED","RESOLVED_DISMISSED"]},"resolve_comment":{"type":"string"}},"required":["status_progress"]}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}}
```
## Retrieve Case Artifacts by Case ID
> This endpoint retrieves the artifacts for a given case\_id
```json
{"openapi":"3.0.0","info":{"title":"Cortex AgentiX APIs","version":"Cortex AgentiX"},"tags":[{"name":"Cases","description":"APIs for managing cases"}],"servers":[{"url":"https://api-{{fqdn}}"}],"paths":{"/public_api/v1/case/artifacts/{case-id}":{"get":{"tags":["Cases"],"summary":"Retrieve Case Artifacts by Case ID","description":"This endpoint retrieves the artifacts for a given case_id","operationId":"getCaseArtifacts","parameters":[{"name":"case-id","in":"path","description":"Numeric ID of the case","required":true,"schema":{"type":"integer"}}],"responses":{"200":{"description":"Successful response with cases","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"TOTAL_COUNT":{"type":"integer"},"FILTER_COUNT":{"type":"integer"},"DATA":{"type":"array","items":{"$ref":"#/components/schemas/CaseArtifact"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalError"}}}}},"components":{"schemas":{"CaseArtifact":{"type":"object","properties":{"case_id":{"type":"integer","description":"Case ID for which the artifacts are fetched"},"network_artifacts":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Artifact"}},"TOTAL_COUNT":{"type":"integer"}}},"file_artifacts":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/Artifact"}},"TOTAL_COUNT":{"type":"integer"}}}}},"Artifact":{"type":"object","properties":{"artifact_id":{"type":"string","description":"Unique identifier for the artifact"},"file_name":{"type":"string","description":"File name for the artifact"},"file_sha256":{"type":"string","description":"File sha256 for the artifact"},"file_signature_status":{"type":"string","description":"File signature for the artifact"},"file_wildfire_verdict":{"type":"string","description":"File wildfire verdict for the artifact"},"is_malicous":{"type":"boolean","description":"Indicates if the artifact is malicous"},"is_manual":{"type":"boolean","description":"Indicates if the artifact is manual"},"is_process":{"type":"boolean","description":"Indicates if the artifact is related_to_process"},"low_confidence":{"type":"boolean","description":"Indicates the artifact confidence"},"type":{"type":"string","description":"Type of the artifact"}}}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Unauthorized":{"description":"Unauthorized access","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"InternalError":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}}
```
## Get War Room entries
> Get the War Room entries for a specific case or alert. You can filter by timestamp, ID, and tags. You can also choose which type of entries you want to retrieve (notes, chat, attachments...).\
> The response depends on what type of entry you choose to retrieve.\
> \
> Required license: \*\*Cortex AgentiX Enterprise\*\* or \*\*Cortex AgentiX Base\*\*
```json
{"openapi":"3.0.0","info":{"title":"Cortex AgentiX APIs","version":"Cortex AgentiX"},"tags":[{"name":"Cases","description":"APIs for managing cases"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/entries/get":{"post":{"tags":["Cases"],"summary":"Get War Room entries","description":"Get the War Room entries for a specific case or alert. You can filter by timestamp, ID, and tags. You can also choose which type of entries you want to retrieve (notes, chat, attachments...).\nThe response depends on what type of entry you choose to retrieve.\n\nRequired license: **Cortex AgentiX Enterprise** or **Cortex AgentiX Base**","operationId":"post-public_api-v1-entries-get","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"The ID of the case or alert you want to get the War Room entries of. For a case ID, prepend \"CASE-\" to the case ID. \nFor example, if the case ID is 3, the value of `id` should be `CASE-3`.\nFor alert IDs, just put the ID. For example, if the alert ID is 3, the value of `id` should be `3`."},"filter":{"type":"object","properties":{"firstID":{"type":"string","description":"Return results starting from the investigation ID in `firstID` until the last investigation ID."},"lastID":{"type":"string","description":"Return results starting from the first investigation ID until the investigation ID in `lastID`."},"pagesize":{"type":"integer","description":"Filter the results by the number of entries you want returned. `\"pagesize\": 0` returns all the results."},"fromTime":{"type":"string","description":"RFC3339 timestamp. Filter results from the time the entry is created until the latest entry."},"categories":{"type":"array","description":"The categories you want to filter and the results you want to receive:\n- `tags`: Tags added to the investigation.\n- `chats`: Communication between team members in the form of chat messages.\n- `notes`: Any entries marked as notes.\n- `attachments`: Any files uploaded to the War Room in a playbook, script, or by the analyst.\n- `incidentInfo`: The case history.\n- `commandAndResults`: Command and return the result of the command.\n- `playbookTaskResult`: Return the task result.\n- `playbookTaskStartAndDone`: Task and return the task result.\n- `playbookErrors`: When there are no playbook errors, the response returned is `0`.","items":{"type":"string","enum":["tags","chats","notes","attachments","incidentInfo","commandAndResults","playbookTaskResult","playbookTaskStartAndDone","playbookErrors"]}},"tags":{"type":"array","description":"If using the filter category of `tags`, include the tags you want to filter by.","items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"total":{"type":"integer"},"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"modified":{"type":"string"},"created":{"type":"string"},"user":{"type":"string"},"parentContent":{"type":"string"},"contents":{"type":"string"},"format":{"type":"string"},"investigationId":{"type":"string"},"category":{"type":"string"},"isTodo":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}}}}}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```
## Add War Room entries
> Add an entry to the cases or alert War Room, including data.\
> Note: This endpoint only adds entries to existing War Rooms; it does not create them. Ensure that the War Room already exists before making this request.\
> \
> Required license: \*\*Cortex AgentiX Enterprise\*\* or \*\*Cortex AgentiX Base\*\*
```json
{"openapi":"3.0.0","info":{"title":"Cortex AgentiX APIs","version":"Cortex AgentiX"},"tags":[{"name":"Cases","description":"APIs for managing cases"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/entries/insert":{"post":{"tags":["Cases"],"summary":"Add War Room entries","description":"Add an entry to the cases or alert War Room, including data.\nNote: This endpoint only adds entries to existing War Rooms; it does not create them. Ensure that the War Room already exists before making this request.\n\nRequired license: **Cortex AgentiX Enterprise** or **Cortex AgentiX Base**","operationId":"post-public_api-v1-entries-insert","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"The ID of the case or issue for which you want to add a War Room entry. For a case ID, prepend \"CASE-\" to the case ID. \nFor example, if the case ID is 3, the value of `id` should be `CASE-3`.\nFor alert IDs, just put the ID. For example, if the alert ID is 3, the value of `id` should be `3`."},"data":{"type":"string","description":"The data you want to add or the command you want to run in the War Room."}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"integer"},"cacheVersn":{"type":"integer"},"modified":{"type":"string"},"sizeInBytes":{"type":"integer"},"type":{"type":"integer"},"created":{"type":"string"},"incidentCreationTime":{"type":"string"},"investigationCreationTime":{"type":"string"},"retryTime":{"type":"string"},"user":{"type":"string"},"errorSource":{"type":"string"},"contents":{"type":"string"},"format":{"type":"string"},"investigationId":{"type":"string"},"file":{"type":"string"},"fileID":{"type":"string"},"parentId":{"type":"string"},"pinned":{"type":"boolean"},"fileMetadata":{"nullable":true},"parentContent":{"nullable":true},"parentEntryTruncated":{"type":"boolean"},"system":{"type":"string"},"reputations":{"nullable":true},"category":{"type":"string"},"note":{"type":"boolean"},"isTodo":{"type":"boolean"},"tags":{"nullable":true},"tagsRaw":{"nullable":true},"startDate":{"type":"string"},"times":{"type":"integer"},"recurrent":{"type":"boolean"},"endingDate":{"type":"string"},"timezoneOffset":{"type":"integer"},"cronView":{"type":"boolean"},"scheduled":{"type":"boolean"},"scheduledEntryGuid":{"type":"string"},"entryTask":{"nullable":true},"taskId":{"type":"string"},"playbookId":{"type":"string"},"reputationSize":{"type":"integer"},"contentsSize":{"type":"integer"},"brand":{"type":"string"},"InstanceID":{"type":"string"},"IndicatorTimeline":{"nullable":true},"Relationships":{"nullable":true},"mirrored":{"type":"boolean"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/cases.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.