Case Commands
getCases
Gets a list of cases from the Cortex platform, according to the passed filters, with optional sorting, pagination, and enrichment. If no filters are provided, all cases are returned.
Arguments
Arguments
case_ids
A comma-separated list of case IDs to filter by.
Optional
sort_by_creation_time
Sorts returned cases by the date/time that the case was created ("asc" - ascending, "desc" - descending). Possible values are: ASC, DESC.
Optional
sort_by_modification_time
Sorts returned cases by the date/time that the case was modified ("asc" - ascending, "desc" - descending). Possible values are: ASC, DESC.
Optional
page
Page number (for pagination). Default is 0.
Optional
limit
The maximum number of cases to return. Defaults to 50. The maximum is 100. Default is 50.
Optional
case_domains
A comma-separated list of domains to filter cases by. Possible values are: DOMAIN_SECURITY, DOMAIN_POSTURE, DOMAIN_IT, DOMAIN_HEALTH, DOMAIN_HUNTING.
Optional
status
A comma-separated list of case statuses to filter cases by. Possible values are: new, in_progress, resolved.
Optional
not_status
A comma-separated list of statuses to exclude. Possible values are: new, in_progress, resolved.
Optional
severities
A comma-separated list of severity levels to filter cases by. Possible values are: low, medium, high, critical.
Optional
asset_ids
A comma-separated list of Asset IDs associated with the case by which to filter the cases.
Optional
asset_groups
A comma-separated list of Asset Group IDs, where the case is filtered by the assets contained within those groups.
Optional
hosts
A comma-separated list of hosts to filter cases by.
Optional
assignees
A comma-separated list of assignee names or emails to filter cases by. Note: all values must be either names or emails - mixing both in the same request is not supported. Use the special values: "assigned" - to get all cases with assignees, "unassigned" - to get cases with no assignees.
Optional
starred
Filter cases by whether they are starred or not. Possible values are: true, false.
Optional
case_names
A comma-separated list of names to filter cases by.
Optional
case_descriptions
A comma-separated list of descriptions to filter cases by.
Optional
lte_creation_time
A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or before the specified datetime will be retrieved.
Optional
gte_creation_time
A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or after the specified datetime will be retrieved.
Optional
since_creation_time
Filters for returned cases that were created on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.
Optional
lte_modification_time
Filters for returned cases that were created on or before the specified datetime with the format 2019-12-31T23:59:00.
Optional
gte_modification_time
Filters for returned cases that were modified on or after the specified datetime with the format 2019-12-31T23:59:00.
Optional
since_modification_time
Filters for returned cases that were modified on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.
Optional
get_enriched_case_data
Whether to include enriched case data in the response (detection_time, notes, xdr_url, manual_description, starred_manually). Only supported for up to 10 cases. When more than 10 cases are returned, the command automatically falls back to standard case data. Possible values are: true, false. Default is false.
Optional
tags
A comma-separated list of tags to filter cases by.
Optional
filter_object
A JSON string representing a raw filter object. If provided, this overrides all other filter arguments.
Optional
Outputs
Outputs
Core.Case.case_id string
Unique ID assigned to each returned case.
Core.Case.case_name string
Name of the case.
Core.Case.description string
Description of the case.
Core.Case.creation_time number
Timestamp when the case was created.
Core.Case.modification_time number
Timestamp when the case was last modified.
Core.Case.resolved_timestamp number
Timestamp when the case was resolved.
Core.Case.status string
Current status of the case.
Core.Case.severity string
Severity level of the case.
Core.Case.caseTeam.id string
User email (for memberType=USER) or group UUID (for memberType=USER_GROUP).
Core.Case.caseTeam.memberType string
The member type. One of: USER, USER_GROUP.
Core.Case.caseTeam.teamRole string
The team role. One of: CONTRIBUTOR, WATCHER.
Core.Case.accessMode string
Case visibility mode. One of: CASE_SCOPE, TEAM_ONLY.
Core.Case.assigned_user_mail string
Email address of the assigned user. May be null.
Core.Case.assigned_user_pretty_name string
Full name of the assigned user. May be null.
Core.Case.issue_count number
Total number of issues in the case.
Core.Case.low_severity_issue_count number
Number of issues with low severity.
Core.Case.med_severity_issue_count number
Number of issues with medium severity.
Core.Case.high_severity_issue_count number
Number of issues with high severity.
Core.Case.critical_severity_issue_count number
Number of issues with critical severity.
Core.Case.user_count number
Number of users involved in the case.
Core.Case.host_count number
Number of hosts involved in the case.
Core.Case.resolve_comment string
Comments added when resolving the case. May be null.
Core.Case.resolve_reason string
The reason for resolving the case. May be null.
Core.Case.manual_severity string
Severity manually assigned by the user. May be null.
Core.Case.starred boolean
Indicates whether the case is starred.
Core.Case.hosts unknown
List of hosts involved in the case.
Core.Case.users unknown
List of users involved in the case.
Core.Case.case_sources string
Sources of the case.
Core.Case.manual_score number
Manually assigned score. May be null.
Core.Case.rule_based_score number
Score based on rules.
Core.Case.wildfire_hits number
Number of WildFire hits.
Core.Case.issues_grouping_status string
Status of issue grouping.
Core.Case.mitre_tactics_ids_and_names unknown
List of MITRE ATT&CK tactic IDs and names associated with the case.
Core.Case.mitre_techniques_ids_and_names unknown
List of MITRE ATT&CK technique IDs and names associated with the case.
Core.Case.issue_categories string
Categories of issues associated with the case.
Core.Case.original_tags string
Original tags assigned to the case.
Core.Case.tags string
Current tags assigned to the case.
Core.Case.case_domain string
Domain associated with the case.
Core.Case.custom_fields unknown
Custom fields for the case with standardized lowercase, whitespace-free names.
Core.Case.CaseExtraData.issue_ids string
List of issue IDs associated with the case.
Core.Case.CaseExtraData.file_artifacts unknown
File artifacts associated with the case.
Core.Case.CaseExtraData.network_artifacts unknown
Network artifacts associated with the case.
Core.Case.CaseExtraData.starred_manually boolean
True if the case was starred manually; false if starred by rules.
Core.Case.CaseExtraData.xdr_url string
URL to view the case in Cortex XDR.
Core.Case.CaseExtraData.manual_description string
Description manually provided by the user.
Core.Case.CaseExtraData.notes string
The notes related to the case.
Core.Case.CaseExtraData.detection_time number
The timestamp when the first issue was detected in the case.
setCase
Updates the properties of a case. Only the fields provided are changed.
Arguments
Arguments
case_ids
A comma-separated list of case IDs to update.
Required
case_name
The new name for the case.
Optional
description
The new description for the case.
Optional
assignee
The email address of the new assignee. Use "unassigned" to remove an existing assignee.
Optional
status
The new status for the case. Possible values are: new, in_progress, resolved.
Optional
notes
Additional notes for the case.
Optional
starred
Whether the case should be starred. Possible values are: true, false.
Optional
user_defined_severity
The user-defined severity for the case. Possible values are: low, medium, high, critical.
Optional
resolve_reason
The reason for resolving the case. Only relevant when status is set to resolved. Possible values are: known_issue, duplicate, false_positive, true_positive, security_testing, other.
Optional
resolved_comment
Comment when resolving the case. Only relevant when status is set to resolved.
Optional
resolve_all_alerts
Whether to resolve all alerts associated with the case. Only relevant when status is set to resolved. Possible values are: true, false.
Optional
custom_fields
A JSON encoded string representing custom field name-value pairs to update.
Optional
case_team_ids
A comma-separated list of case team member identifiers. Each entry is a user email (when the matching case_team_member_types is "USER") or a group UUID (when the matching case_team_member_types is "USER_GROUP"). This list is positional and zipped with case_team_member_types and case_team_roles — all three lists must have the same length. Each id is validated server-side: user emails via get_users and group UUIDs via get_groups; invalid entries are silently removed. To clear the team pass an empty list together with case_team_operation="REPLACE". Example: case_team_ids="user@company.com,admin@company.com,soc-group-uuid".
Optional
case_team_member_types
A comma-separated list of member types, one per entry in case_team_ids. Positional and parallel to case_team_ids and case_team_roles — all three lists must have the same length. Allowed values per entry are exactly "USER" or "USER_GROUP" (uppercase). Example: case_team_member_types="USER,USER,USER_GROUP". Possible values are: USER, USER_GROUP.
Optional
case_team_roles
A comma-separated list of team roles, one per entry in case_team_ids. Positional and parallel to case_team_ids and case_team_member_types — all three lists must have the same length. Allowed values per entry are exactly "CONTRIBUTOR" or "WATCHER" (uppercase). Example: case_team_roles="CONTRIBUTOR,WATCHER,WATCHER". Possible values are: CONTRIBUTOR, WATCHER.
Optional
case_team_operation
Controls how case_team entries are applied. Required whenever any of case_team_ids, case_team_member_types or case_team_roles is provided. REPLACE overwrites the entire team with the provided entries. ADD appends entries to the existing team (existing identity + new role overwrites the stored role). REMOVE deletes entries (only id needs to match). Possible values are: REPLACE, ADD, REMOVE.
Optional
access_mode
Controls case visibility. CASE_SCOPE — any user whose scope permits can view the case. TEAM_ONLY — restricts access to team members only. Only sent when explicitly provided. Possible values are: CASE_SCOPE, TEAM_ONLY.
Optional
Outputs
Outputs
Core.Case.id string
The unique identifier of the case.
Core.Case.severity string
The case severity.
Core.Case.creationTime number
The creation time of the case in milliseconds.
Core.Case.lastUpdateTime number
The last update time of the case in milliseconds.
Core.Case.caseDomain string
Domain of the case.
Core.Case.internalStatus string
Internal status of the case.
Core.Case.hasAttachment boolean
Whether the case has attachments.
Core.Case.modifiedBy string
User who last modified the case.
Core.Case.notes string
Notes associated with the case.
Core.Case.caseTeam.id string
User email (for memberType=USER) or group UUID (for memberType=USER_GROUP).
Core.Case.caseTeam.memberType string
The member type. One of: USER, USER_GROUP.
Core.Case.caseTeam.teamRole string
The team role. One of: CONTRIBUTOR, WATCHER.
Core.Case.accessMode string
Case visibility mode. One of: CASE_SCOPE, TEAM_ONLY.
Last updated
Was this helpful?