> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/cases-papi-tables.md). # Additional References ## Supported Filter Fields & Operators Used by the [**Get Cases**](/xdr-5-api/cases-apis/cases-apis-overview.md#getCases) endpoint to define the supported fields, operators, and values for the `filters` parameter. | Field | Supported Operators | Value Type | | ----------------------------- | ------------------------- | --------------------------------------------------------------------------------------- | | `case_id` | `in`, `nin` | Array of integers | | `starred` | `in`, `nin` | Boolean | | `case_domain` | `in`, `nin` | Array of strings (for example,. 'Security', 'Posture', 'Health') | | `severity` | `in`, `nin` | Array of strings: `info`, `low`, `medium`, `high`, `critical` | | `creation_time` | `gte`, `lte`, `eq`, `neq` | Integer (epoch milliseconds) | | `last_update_time` | `gte`, `lte`, `eq`, `neq` | Integer (epoch milliseconds) | | `status_progress` | `in`, `nin` | Array of strings (for example,. 'New', 'In Progress', 'Resolved', plus custom statuses) | | `assigned_user` | `in`, `nin` | Array of strings (email addresses) | | `assigned_user_pretty` | `in`, `nin` | Array of strings (display names) | | `asset_ids` | `contains` | Array of strings | | `asset_names` | `contains` | Array of strings | | `asset_classes` | `contains` | Array of strings | | `asset_group_ids` | `contains` | Array of strings | | `asset_categories` | `contains` | Array of strings | | `asset_regions` | `contains` | Array of strings | | `asset_providers` | `contains` | Array of strings | | `asset_accounts` | `contains` | Array of strings | | `asset_types` | `contains` | Array of strings | | `asset_cloud_account_names` | `contains` | Array of strings | | `asset_external_provider_ids` | `contains` | Array of strings | ## Update Fields | Field | Required | Accepted Values | | ----------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `status_progress` | No | 'New', 'In Progress', 'Resolved'. Additional custom statuses may be configured per tenant and case domain. | | `resolve_reason` | Required when resolving | 'Resolved - Known Issue', 'Resolved - Duplicate Case', 'Resolved - False Positive', 'Resolved - Other', 'Resolved - True Positive', 'Resolved - Security Testing'. Additional values may be available depending on tenant configuration. Must be provided when `status_progress` is 'Resolved'. Cannot be provided otherwise. Automatically cleared when status changes away from 'Resolved'. | | `resolve_comment` | No | Free-text string. Only applicable when `status_progress` is 'Resolved'. Cannot be provided otherwise. Automatically cleared when status changes away from 'Resolved'. | | `user_severity` | No | 'low', 'medium', 'high', 'critical'. Use an empty string `""` to clear. | | `assigned_user` | No | Valid Cortex XDR email address. | | `notes` | No | Free-text string. | | Custom fields | No | Pass custom field name as key directly in `update_data`. Accepted values depend on field configuration. | ## Case Timeline Record Filter Fields and Operators | Field | Supported Operators | Value Type | | -------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `record_type` | `in`, `nin`, `eq`, `neq` | String or array of strings (for example, `Detection`, `Response`, `Case activity`, `Automation`, `System update`) | | `record_subtype` | `in`, `nin`, `eq`, `neq` | String or array of strings (for example,. `Issue created`, `Case created`, `Case assigned`, `Status changed`, `Severity changed`, `Score changed`, `Description changed`, `Name changed`, `Field updated`, `Comment added / deleted`, `Case starred`, `Case merged`, `Issues grouped`, `Issues linked to case`, `Issues unlinked from case`, `Note added`, `Team changed`, `Playbook executed`, `Response action`) | | `source` | `in`, `nin`, `eq`, `neq` | String or array of strings (for example,. `User`, `Automation`, `System`, `API Key`) | | `record_name` | `eq`, `neq`, `contains`, `not_contains` | String | | `source_id` | `eq`, `neq`, `contains`, `not_contains` | String | | `record_id` | `eq`, `neq`, `contains`, `not_contains` | String | | `evidence_comment` | `eq`, `neq`, `contains`, `not_contains` | String | | `evidence_flag_by` | `eq`, `neq`, `contains`, `not_contains` | String | | `occurred_at` | `gte`, `lte` | Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted) | | `creation_time` | `gte`, `lte` | Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted) | | `evidence_flag_time` | `gte`, `lte` | Integer (epoch milliseconds; epoch seconds are also accepted and automatically converted) | | `is_evidence` | `eq` | Boolean | | `tags` | `contains`, `not_contains` | String (single tag value) | | `timelines` | `contains`, `not_contains` | String (single timeline value) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/cases-papi-tables.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.