Cases
Cases APIs to search and update cases, retrieve case artifacts, manage War Room entries, retrieve timeline records, and add manual timeline records to cases.
This endpoint retrieves a list of cases that match the specified filter criteria. It supports filtering, sorting, and pagination.
Supported Filter Fields & Operators
See the Supported Filter Fields & Operators for more details.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
{api_key}
{api_key_id}
Successful response with cases
Bad request
Unauthorized access
Internal server error
POST /public_api/v1/case/search HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 153
{
"request_data": {
"filters": [
{
"field": "case_id",
"operator": "in",
"value": [
1
]
}
],
"search_from": 0,
"search_to": 100,
"sort": {
"field": "case_id",
"keyword": "asc"
}
}
}{
"reply": {
"TOTAL_COUNT": 1,
"FILTER_COUNT": 1,
"DATA": [
{
"case_id": 834,
"is_blocked": false,
"case_name": "Windows Installer exploitation for local privilege escalation",
"creation_time": 1776902615000,
"modification_time": 1776902615000,
"status_progress": "Resolved",
"resolve_reason": "Resolved - Other",
"severity": "high",
"description": "Reduce risk from the listed configuration issues through the primary AWS asset.",
"assigned_user_mail": "user@example.com",
"assigned_user_pretty_name": "Jane Smith",
"issue_count": 1,
"user_severity": "medium",
"notes": "Investigation complete, no further action needed.",
"low_severity_issue_count": 0,
"med_severity_issue_count": 0,
"high_severity_issue_count": 1,
"critical_severity_issue_count": 0,
"user_count": 0,
"host_count": 1,
"resolve_comment": "Resolved via public API.",
"resolved_timestamp": 1708950896000,
"xdr_url": "https://your-fqdn.xdr.us.paloaltonetworks.com/incident-view?caseId=834",
"starred": false,
"hosts": [
"host-1:a8d24e796ef264a33e6e84c707ff2f67"
],
"users": [
"admin"
],
"aggregated_score": 85,
"wildfire_hits": 0,
"mitre_tactics_ids_and_names": [
"TA0004 - Privilege Escalation"
],
"mitre_techniques_ids_and_names": [
"T1068 - Exploitation for Privilege Escalation"
],
"issue_categories": [
"Privilege Escalation"
],
"tags": [
"DS:PANW/XSIAM Manual",
"DOM:Security"
],
"custom_fields": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"asset_ids": [
"text"
],
"asset_group_ids": [
"text"
],
"asset_group_names": [
"text"
],
"assets": [
{
"asset_id": "a8d24e796ef264a33e6e84c707ff2f67",
"asset_name": "systest-uai-instance-itnc",
"asset_type": "EC2 Instance",
"asset_region": "us-east-1",
"asset_group_ids": [
1,
5,
7
],
"asset_provider": "AWS",
"asset_account": "195898722190",
"asset_category": "VM Instance",
"asset_cloud_account_name": "195898722190",
"asset_external_provider_id": "text",
"asset_tags": {
"environment": "production",
"team": "platform-security"
},
"asset_group_names": [
"text"
]
}
],
"case_domain": "Security",
"issue_ids": [
890
],
"file_artifact_ids": {
"DATA": [
"e872623cc49d1c5cdce7c1ff4c481153"
],
"TOTAL_COUNT": 1
},
"network_artifact_ids": {
"DATA": [],
"TOTAL_COUNT": 0
},
"case_team": [
{
"id": "text",
"member_type": "USER",
"team_role": "OWNER"
}
],
"access_mode": "CASE_SCOPE"
}
]
}
}Update an existing case in the system. Users can only update one case at a time.
At least one valid update field must be provided in update_data. An empty update_data object will return a 400 error. All field values must be non-null.
Update Fields
See the Update Fields for more details.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
Numeric ID of the case to update
{api_key}
{api_key_id}
Case updated successfully
No content
Bad request
Unauthorized access
Internal server error
POST /public_api/v1/case/update/{case-id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 392
{
"request_data": {
"update_data": {
"status_progress": "Resolved",
"resolve_reason": "Resolved - Other",
"resolve_comment": "Resolved via public API.",
"notes": "Investigation complete, no further action needed.",
"user_severity": "high",
"assigned_user": "john_doe@domain.com",
"case_team": [
{
"id": "text",
"member_type": "USER",
"team_role": "OWNER"
}
],
"access_mode": "CASE_SCOPE",
"ANY_ADDITIONAL_PROPERTY": null
}
}
}No content
This endpoint retrieves the artifacts for a given case_id.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
Numeric ID of the case
{api_key}
{api_key_id}
Successful response with case artifacts
Case ID for which the artifacts are fetched
1234Bad request
Unauthorized access
Internal server error
GET /public_api/v1/case/artifacts/{case-id}/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
[
{
"case_id": 1234,
"network_artifacts": {
"DATA": [
{
"artifact_id": "A12345",
"file_name": "test",
"file_sha256": "abc123def456",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "BENIGN",
"is_malicious": true,
"is_manual": false,
"is_process": false,
"low_confidence": false,
"type": "HASH"
}
],
"TOTAL_COUNT": 10
},
"file_artifacts": {
"DATA": [
{
"artifact_id": "A12345",
"file_name": "test",
"file_sha256": "abc123def456",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "BENIGN",
"is_malicious": true,
"is_manual": false,
"is_process": false,
"low_confidence": false,
"type": "HASH"
}
],
"TOTAL_COUNT": 10
}
}
]Returns the schema of all available case fields, including core fields and tenant-specific custom fields. Each entry includes the field name, a human-readable display name, and the data type.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
{api_key}
{api_key_id}
Successful response with cases schema
Unauthorized access
Internal server error
GET /public_api/v1/case/schema HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"reply": [
{
"field_name": "case_id",
"field_pretty_name": "Case ID",
"data_type": "INT"
}
]
}Retrieve the timeline records for a specific case. Supports filtering, sorting, and pagination. Returns flat timeline records (no clustering).
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.
Numeric ID of the case
12345{api_key}
{api_key_id}
1OK. Request Successful.
Bad Request
Unauthorized.
POST /public_api/v1/case/timeline/{case-id}/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 175
{
"request_data": {
"filters": [
{
"field": "record_type",
"operator": "in",
"value": [
"Case activity"
]
}
],
"search_from": 0,
"search_to": 100,
"sort": {
"field": "occurred_at",
"keyword": "asc"
}
}
}{
"reply": {
"DATA": [
{
"record_id": "4f2d9b8c7a1e4d6fb3c2a1d9e8f7b6c5",
"record_name": "Case timeline record",
"description": "Case status changed from Open to Resolved.",
"record_type": "Case activity",
"record_subtype": "Note added",
"timelines": [
"Test"
],
"tags": [
"important"
],
"source": "API Key",
"source_id": "123",
"creation_time": 1735689600000,
"occurred_at": 1735689600000,
"is_evidence": true,
"evidence_title": "Service Account has cross cloud admin permissions",
"evidence_comment": "Key evidence findings",
"evidence_flag_time": 1784276913000,
"evidence_flag_by": "John Doe",
"attachments": [
{
"filename": "evidence.png"
}
],
"query_execution_id": "query_exec_example_001"
}
],
"FILTER_COUNT": 1,
"TOTAL_COUNT": 4
}
}Adds a manual timeline record to the specified case. The API automatically sets the source field to API Key and the source_id field to the ID of the API key used for the request.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.
Numeric ID of the case
12345{api_key}
{api_key_id}
1OK. The timeline record was created successfully.
Bad Request
POST /public_api/v1/case/timeline/{case-id}/add_record/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 326
{
"request_data": {
"record_type": "Case activity",
"record_name": "Manual investigation note",
"occurred_at": 1779220493000,
"description": "Analyst reviewed the affected host and confirmed remediation.",
"is_evidence": true,
"evidence_comment": "Key finding for the investigation.",
"tags": [
"investigation"
],
"timelines": [
"Investigation"
]
}
}{
"reply": {
"record_id": "4f2d9b8c7a1e4d6fb3c2a1d9e8f7b6c5",
"case_id": 12345
}
}Get the War Room entries for a specific case or alert. You can filter by timestamp, ID, and tags. You can also choose which type of entries you want to retrieve (notes, chat, attachments...). The response depends on what type of entry you choose to retrieve.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
{api_key}
{api_key_id}
The unique identifier of the case or alert for which the War Room entry is created.
- Case IDs must be prefixed with
INCIDENT-(for example,INCIDENT-3). - Alert IDs should be provided without any prefix (for example,
3).
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/entries/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 126
{
"id": "text",
"filter": {
"firstID": "text",
"lastID": "text",
"pagesize": 1,
"fromTime": "text",
"categories": [
"tags"
],
"tags": [
"text"
]
}
}{
"total": 2,
"data": [
{
"id": "f1db36f0-d00f-4470-818f-c6911d392f76@INCIDENT-1",
"modified": "2025-01-02T10:17:57.738577545Z",
"created": "2025-01-01T13:15:48.302901Z",
"user": "",
"parentContent": "!markAsNote entryIDs=\"1\"",
"contents": "done",
"format": "text",
"investigationId": "INCIDENT-1",
"category": "artifact",
"isTodo": false,
"tags": [
"john100"
]
},
{
"id": "0d6a01a4-58b5-4121-8db7-c371e38284db@INCIDENT-1",
"modified": "2025-01-02T10:22:26.6396269Z",
"created": "2025-01-02T09:11:51.747644Z",
"user": "",
"contents": "'aaaaaa'",
"format": "text",
"investigationId": "INCIDENT-1",
"category": "artifact",
"isTodo": false,
"tags": [
"john200"
]
}
]
}Add an entry to the cases or alert War Room, including data. Note: This endpoint only adds entries to existing War Rooms; it does not create them. Ensure that the War Room already exists before making this request.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management
{api_key}
{api_key_id}
The unique identifier of the case/issue or alert for which the War Room entry is created.
- Case or issue IDs must be prefixed with
INCIDENT-(for example,INCIDENT-3). - Alert IDs should be provided without any prefix (for example,
3).
The data you want to add or the command you want to run in the War Room.
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/entries/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 37
{
"id": "1",
"data": "!Print value=1000"
}{
"id": "b30fadee-53e3-4859-8c79-fa328ba7b4fd@1",
"version": 1,
"cacheVersn": 0,
"modified": "2025-01-29T13:48:41.591466357Z",
"sizeInBytes": 0,
"type": 1,
"created": "2025-01-29T13:48:41.591444333Z",
"incidentCreationTime": "2025-01-29T13:48:41.591444333Z",
"investigationCreationTime": "2024-12-25T14:43:07.697Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "",
"errorSource": "",
"contents": "!Print value=1",
"format": "text",
"investigationId": "1",
"file": "",
"fileID": "",
"parentId": "",
"pinned": false,
"fileMetadata": null,
"parentContent": null,
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "chat",
"note": false,
"isTodo": false,
"tags": null,
"tagsRaw": null,
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 14,
"brand": "none",
"InstanceID": "",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}Last updated
Was this helpful?