Additional References

Supported Filter Fields & Operators

Used by the Get Cases endpoint to define the supported fields, operators, and values for the filters parameter.

Field	Supported Operators	Value Type
case_id	in, nin	Array of integers
starred	in, nin	Boolean
case_domain	in, nin	Array of strings (for example,. 'Security', 'Posture', 'Health')
severity	in, nin	Array of strings: info, low, medium, high, critical
creation_time	gte, lte, eq, neq	Integer (epoch milliseconds)
last_update_time	gte, lte, eq, neq	Integer (epoch milliseconds)
status_progress	in, nin	Array of strings (for example,. 'New', 'In Progress', 'Resolved', plus custom statuses)
assigned_user	in, nin	Array of strings (email addresses)
assigned_user_pretty	in, nin	Array of strings (display names)
asset_ids	contains	Array of strings
asset_names	contains	Array of strings
asset_classes	contains	Array of strings
asset_group_ids	contains	Array of strings
asset_categories	contains	Array of strings
asset_regions	contains	Array of strings
asset_providers	contains	Array of strings
asset_accounts	contains	Array of strings
asset_types	contains	Array of strings
asset_cloud_account_names	contains	Array of strings
asset_external_provider_ids	contains	Array of strings

Update Fields

Field	Required	Accepted Values
status_progress	No	'New', 'In Progress', 'Resolved'. Additional custom statuses may be configured per tenant and case domain.
resolve_reason	Required when resolving	'Resolved - Known Issue', 'Resolved - Duplicate Case', 'Resolved - False Positive', 'Resolved - Other', 'Resolved - True Positive', 'Resolved - Security Testing'. Additional values may be available depending on tenant configuration. Must be provided when status_progress is 'Resolved'. Cannot be provided otherwise. Automatically cleared when status changes away from 'Resolved'.
resolve_comment	No	Free-text string. Only applicable when status_progress is 'Resolved'. Cannot be provided otherwise. Automatically cleared when status changes away from 'Resolved'.
user_severity	No	'low', 'medium', 'high', 'critical'. Use an empty string "" to clear.
assigned_user	No	Valid Cortex XDR email address.
notes	No	Free-text string.
Custom fields	No	Pass custom field name as key directly in update_data. Accepted values depend on field configuration.

Case Timeline Record Filter Fields and Operators

Field	Supported Operators	Value Type
record_type	in, nin, eq, neq	String or array of strings (for example, Detection, Response, Case activity, Automation, System update)
record_subtype	in, nin, eq, neq	String or array of strings (for example,. Issue created, Case created, Case assigned, Status changed, Severity changed, Score changed, Description changed, Name changed, Field updated, Comment added / deleted, Case starred, Case merged, Issues grouped, Issues linked to case, Issues unlinked from case, Note added, Team changed, Playbook executed, Response action)
source	in, nin, eq, neq	String or array of strings (for example,. User, Automation, System, API Key)
record_name	eq, neq, contains, not_contains	String
source_id	eq, neq, contains, not_contains	String
record_id	eq, neq, contains, not_contains	String
evidence_comment	eq, neq, contains, not_contains	String
evidence_flag_by	eq, neq, contains, not_contains	String
occurred_at	gte, lte	Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted)
creation_time	gte, lte	Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted)
evidence_flag_time	gte, lte	Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted)
is_evidence	eq	Boolean
tags	contains, not_contains	String (single tag value)
timelines	contains, not_contains	String (single timeline value)