> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/case-commands.md).
# Case Commands
* [getCases](#getcases)
* [setCase](#setcase)
#### getCases
***
Gets a list of cases from the Cortex platform, according to the passed filters, with optional sorting, pagination, and enrichment. If no filters are provided, all cases are returned.
**Arguments**
Arguments
| Argument Name | Description | Required |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| case\_ids | A comma-separated list of case IDs to filter by. | Optional |
| sort\_by\_creation\_time | Sorts returned cases by the date/time that the case was created ("asc" - ascending, "desc" - descending). Possible values are: ASC, DESC. | Optional |
| sort\_by\_modification\_time | Sorts returned cases by the date/time that the case was modified ("asc" - ascending, "desc" - descending). Possible values are: ASC, DESC. | Optional |
| page | Page number (for pagination). Default is 0. | Optional |
| limit | Maximum number of cases to return per page. The maximum value is 50. Default is 50. | Optional |
| case\_domains | A comma-separated list of domains to filter cases by. Possible values are: DOMAIN\_SECURITY, DOMAIN\_POSTURE, DOMAIN\_IT, DOMAIN\_HEALTH, DOMAIN\_HUNTING. | Optional |
| status | A comma-separated list of case statuses to filter cases by. Possible values are: new, in\_progress, resolved. | Optional |
| not\_status | A comma-separated list of statuses to exclude. Possible values are: new, in\_progress, resolved. | Optional |
| severities | A comma-separated list of severity levels to filter cases by. Possible values are: low, medium, high, critical. | Optional |
| asset\_ids | A comma-separated list of Asset IDs associated with the case by which to filter the cases. | Optional |
| asset\_groups | A comma-separated list of Asset Group IDs, where the case is filtered by the assets contained within those groups. | Optional |
| hosts | A comma-separated list of hosts to filter cases by. | Optional |
| assignees | A comma-separated list of assignee names or emails to filter cases by. Note: all values must be either names or emails - mixing both in the same request is not supported. Use the special values: "assigned" - to get all cases with assignees, "unassigned" - to get cases with no assignees. | Optional |
| starred | Filter cases by whether they are starred or not. Possible values are: true, false. | Optional |
| case\_names | A comma-separated list of names to filter cases by. | Optional |
| case\_descriptions | A comma-separated list of descriptions to filter cases by. | Optional |
| lte\_creation\_time | A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or before the specified datetime will be retrieved. | Optional |
| gte\_creation\_time | A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or after the specified datetime will be retrieved. | Optional |
| since\_creation\_time | Filters for returned cases that were created on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on. | Optional |
| lte\_modification\_time | Filters for returned cases that were created on or before the specified datetime with the format 2019-12-31T23:59:00. | Optional |
| gte\_modification\_time | Filters for returned cases that were modified on or after the specified datetime with the format 2019-12-31T23:59:00. | Optional |
| since\_modification\_time | Filters for returned cases that were modified on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on. | Optional |
| get\_enriched\_case\_data | Whether to include enriched case data in the response (detection\_time, notes, xdr\_url, manual\_description, starred\_manually). Only supported for up to 10 cases. When more than 10 cases are returned, the command automatically falls back to standard case data. Possible values are: true, false. Default is false. | Optional |
| tags | A comma-separated list of tags to filter cases by. | Optional |
| filter\_object | A JSON string representing a raw filter object. If provided, this overrides all other filter arguments. | Optional |
**Outputs**
Outputs
**Core.Case.case\_id** *string*
Unique ID assigned to each returned case.
**Core.Case.case\_name** *string*
Name of the case.
**Core.Case.description** *string*
Description of the case.
**Core.Case.creation\_time** *number*
Timestamp when the case was created.
**Core.Case.modification\_time** *number*
Timestamp when the case was last modified.
**Core.Case.resolved\_timestamp** *number*
Timestamp when the case was resolved.
**Core.Case.status** *string*
Current status of the case.
**Core.Case.severity** *string*
Severity level of the case.
**Core.Case.caseTeam.id** *string*
User email (for memberType=USER) or group UUID (for memberType=USER\_GROUP).
**Core.Case.caseTeam.memberType** *string*
The member type. One of: USER, USER\_GROUP.
**Core.Case.caseTeam.teamRole** *string*
The team role. One of: CONTRIBUTOR, WATCHER.
**Core.Case.accessMode** *string*
Case visibility mode. One of: CASE\_SCOPE, TEAM\_ONLY.
**Core.Case.assigned\_user\_mail** *string*
Email address of the assigned user. May be null.
**Core.Case.assigned\_user\_pretty\_name** *string*
Full name of the assigned user. May be null.
**Core.Case.issue\_count** *number*
Total number of issues in the case.
**Core.Case.low\_severity\_issue\_count** *number*
Number of issues with low severity.
**Core.Case.med\_severity\_issue\_count** *number*
Number of issues with medium severity.
**Core.Case.high\_severity\_issue\_count** *number*
Number of issues with high severity.
**Core.Case.critical\_severity\_issue\_count** *number*
Number of issues with critical severity.
**Core.Case.user\_count** *number*
Number of users involved in the case.
**Core.Case.host\_count** *number*
Number of hosts involved in the case.
**Core.Case.resolve\_comment** *string*
Comments added when resolving the case. May be null.
**Core.Case.resolve\_reason** *string*
The reason for resolving the case. May be null.
**Core.Case.manual\_severity** *string*
Severity manually assigned by the user. May be null.
**Core.Case.starred** *boolean*
Indicates whether the case is starred.
**Core.Case.hosts** *unknown*
List of hosts involved in the case.
**Core.Case.users** *unknown*
List of users involved in the case.
**Core.Case.case\_sources** *string*
Sources of the case.
**Core.Case.manual\_score** *number*
Manually assigned score. May be null.
**Core.Case.rule\_based\_score** *number*
Score based on rules.
**Core.Case.wildfire\_hits** *number*
Number of WildFire hits.
**Core.Case.issues\_grouping\_status** *string*
Status of issue grouping.
**Core.Case.mitre\_tactics\_ids\_and\_names** *unknown*
List of MITRE ATT\&CK tactic IDs and names associated with the case.
**Core.Case.mitre\_techniques\_ids\_and\_names** *unknown*
List of MITRE ATT\&CK technique IDs and names associated with the case.
**Core.Case.issue\_categories** *string*
Categories of issues associated with the case.
**Core.Case.original\_tags** *string*
Original tags assigned to the case.
**Core.Case.tags** *string*
Current tags assigned to the case.
**Core.Case.case\_domain** *string*
Domain associated with the case.
**Core.Case.custom\_fields** *unknown*
Custom fields for the case with standardized lowercase, whitespace-free names.
**Core.Case.CaseExtraData.issue\_ids** *string*
List of issue IDs associated with the case.
**Core.Case.CaseExtraData.file\_artifacts** *unknown*
File artifacts associated with the case.
**Core.Case.CaseExtraData.network\_artifacts** *unknown*
Network artifacts associated with the case.
**Core.Case.CaseExtraData.starred\_manually** *boolean*
True if the case was starred manually; false if starred by rules.
**Core.Case.CaseExtraData.xdr\_url** *string*
URL to view the case in Cortex XDR.
**Core.Case.CaseExtraData.manual\_description** *string*
Description manually provided by the user.
**Core.Case.CaseExtraData.notes** *string*
The notes related to the case.
**Core.Case.CaseExtraData.detection\_time** *number*
The timestamp when the first issue was detected in the case.
#### setCase
***
Updates the properties of a case. Only the fields provided are changed.
**Arguments**
Arguments
| Argument Name | Description | Required |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| case\_ids | A comma-separated list of case IDs to update. | Required |
| case\_name | The new name for the case. | Optional |
| description | The new description for the case. | Optional |
| assignee | The email address of the new assignee. Use "unassigned" to remove an existing assignee. | Optional |
| status | The new status for the case. Possible values are: new, in\_progress, resolved. | Optional |
| notes | Additional notes for the case. | Optional |
| starred | Whether the case should be starred. Possible values are: true, false. | Optional |
| user\_defined\_severity | The user-defined severity for the case. Possible values are: low, medium, high, critical. | Optional |
| resolve\_reason | The reason for resolving the case. Only relevant when status is set to resolved. Possible values are: known\_issue, duplicate, false\_positive, true\_positive, security\_testing, other. | Optional |
| resolved\_comment | Comment when resolving the case. Only relevant when status is set to resolved. | Optional |
| resolve\_all\_alerts | Whether to resolve all alerts associated with the case. Only relevant when status is set to resolved. Possible values are: true, false. | Optional |
| custom\_fields | A JSON encoded string representing custom field name-value pairs to update. | Optional |
| case\_team\_ids | A comma-separated list of case team member identifiers. Each entry is a user email (when the matching case\_team\_member\_types is "USER") or a group UUID (when the matching case\_team\_member\_types is "USER\_GROUP"). This list is positional and zipped with case\_team\_member\_types and case\_team\_roles — all three lists must have the same length. Each id is validated server-side: user emails via get\_users and group UUIDs via get\_groups; invalid entries are silently removed. To clear the team pass an empty list together with case\_team\_operation="REPLACE". Example: case\_team\_ids=",,soc-group-uuid". | Optional |
| case\_team\_member\_types | A comma-separated list of member types, one per entry in case\_team\_ids. Positional and parallel to case\_team\_ids and case\_team\_roles — all three lists must have the same length. Allowed values per entry are exactly "USER" or "USER\_GROUP" (uppercase). Example: case\_team\_member\_types="USER,USER,USER\_GROUP". Possible values are: USER, USER\_GROUP. | Optional |
| case\_team\_roles | A comma-separated list of team roles, one per entry in case\_team\_ids. Positional and parallel to case\_team\_ids and case\_team\_member\_types — all three lists must have the same length. Allowed values per entry are exactly "CONTRIBUTOR" or "WATCHER" (uppercase). Example: case\_team\_roles="CONTRIBUTOR,WATCHER,WATCHER". Possible values are: CONTRIBUTOR, WATCHER. | Optional |
| case\_team\_operation | Controls how case\_team entries are applied. Required whenever any of case\_team\_ids, case\_team\_member\_types or case\_team\_roles is provided. REPLACE overwrites the entire team with the provided entries. ADD appends entries to the existing team. REMOVE deletes entries (only id needs to match). Possible values are: REPLACE, ADD, REMOVE. | Optional |
| access\_mode | Controls case visibility. CASE\_SCOPE — any user whose scope permits can view the case. TEAM\_ONLY — restricts access to team members only. Only sent when explicitly provided. Possible values are: CASE\_SCOPE, TEAM\_ONLY. | Optional |
**Outputs**
Outputs
**Core.Case.id** *string*
The unique identifier of the case.
**Core.Case.severity** *string*
The case severity.
**Core.Case.creationTime** *number*
The creation time of the case in milliseconds.
**Core.Case.lastUpdateTime** *number*
The last update time of the case in milliseconds.
**Core.Case.caseDomain** *string*
Domain of the case.
**Core.Case.internalStatus** *string*
Internal status of the case.
**Core.Case.hasAttachment** *boolean*
Whether the case has attachments.
**Core.Case.modifiedBy** *string*
User who last modified the case.
**Core.Case.notes** *string*
Notes associated with the case.
**Core.Case.caseTeam.id** *string*
User email (for memberType=USER) or group UUID (for memberType=USER\_GROUP).
**Core.Case.caseTeam.memberType** *string*
The member type. One of: USER, USER\_GROUP.
**Core.Case.caseTeam.teamRole** *string*
The team role. One of: CONTRIBUTOR, WATCHER.
**Core.Case.accessMode** *string*
Case visibility mode. One of: CASE\_SCOPE, TEAM\_ONLY.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/case-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.