Cases

core.cases.create_case

Create a new case.

Inputs

description · string · required

The description of the case.

summary · string · required

The summary of the case.

create_missing_tags · boolean

If true, create any tags that do not already exist.

Default: false.

dropdown_values · array[CaseDropdownValueInput] | null

Dropdown selections to set on the case. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).

Default: null.

fields · object | null

Custom fields for the case.

Default: null.

payload · object | null

Payload for the case.

Default: null.

priority · string

The priority of the case.

Default: "unknown".

Allowed values: unknown, low, medium, high, critical, other.

severity · string

The severity of the case.

Default: "unknown".

Allowed values: unknown, informational, low, medium, high, critical, fatal, other.

status · string

The status of the case.

Default: "unknown".

Allowed values: unknown, new, in_progress, on_hold, resolved, closed, other.

tags · array[string] | null

List of tag identifiers (IDs or refs) to add to the case.

Default: null.

Examples

Create a case

- ref: create_case
  action: core.cases.create_case
  args:
    summary: "Investigate alert ${{ TRIGGER.alert_id }}"
    description: "Created from workflow trigger."
    priority: high
    severity: high
    tags:
      - phishing

core.cases.get_case

Get details of a specific case by ID.

Inputs

case_id · string · required

The ID of the case to retrieve.

Examples

Get a case

- ref: get_case
  action: core.cases.get_case
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.update_case

Update an existing case.

Inputs

case_id · string · required

The ID of the case to update.

append · boolean

If true, append the provided description to the existing description when it is not empty.

Default: false.

create_missing_tags · boolean

If true, create any tags that do not already exist.

Default: false.

description · string | null

The updated description of the case.

Default: null.

dropdown_values · array[CaseDropdownValueInput] | null

Dropdown selections to set or clear. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).

Default: null.

fields · object | null

Updated custom fields for the case.

Default: null.

payload · object | null

Updated payload for the case.

Default: null.

priority · string | null

The updated priority of the case.

Default: null.

severity · string | null

The updated severity of the case.

Default: null.

status · string | null

The updated status of the case.

Default: null.

summary · string | null

The updated summary of the case.

Default: null.

tags · array[string] | null

List of tag identifiers (IDs or refs) to set on the case. This will replace all existing tags.

Default: null.

Examples

Update case fields

- ref: update_case
  action: core.cases.update_case
  args:
    case_id: ${{ TRIGGER.case_id }}
    status: in_progress
    priority: critical
    append: true
    description: |
      Analyst note:
      - Escalated after credential theft indicators were confirmed.

core.cases.list_cases

List all cases.

Inputs

cursor · string | null

Pagination cursor used to fetch a specific page when paginate=true.

Default: null.

limit · integer

Maximum number of cases to return.

Default: 100.

order_by · string | null

The field to order the cases by.

Default: null.

paginate · boolean

If true, return cursor pagination metadata along with items.

Default: false.

reverse · boolean

Reverse pagination direction when paginate=true.

Default: false.

sort · string | null

The direction to order the cases by.

Default: null.

Examples

List cases

- ref: list_cases
  action: core.cases.list_cases
  args:
    limit: 25
    order_by: updated_at
    sort: desc

core.cases.search_cases

Search cases based on various criteria.

Inputs

assignee_id · string | array[string] | null

Filter by assignee ID or ‘unassigned’.

Default: null.

cursor · string | null

Pagination cursor used to fetch a specific page when paginate=true.

Default: null.

dropdown · array[string] | null

Filter by dropdown values in definition_ref:option_ref format.

Default: null.

end_time · string | null

Filter cases created before this time.

Default: null.

limit · integer

Maximum number of cases to return.

Default: 100.

order_by · string | null

The field to order the cases by.

Default: null.

paginate · boolean

If true, return cursor pagination metadata along with items.

Default: false.

priority · string | array[string] | null

Filter by case priority.

Default: null.

reverse · boolean

Reverse pagination direction when paginate=true.

Default: false.

search_term · string | null

Text to search for in case summary and description.

Default: null.

severity · string | array[string] | null

Filter by case severity.

Default: null.

short_id · string | null

Filter by case short_id.

Default: null.

sort · string | null

The direction to order the cases by.

Default: null.

start_time · string | null

Filter cases created after this time.

Default: null.

status · string | array[string] | null

Filter by case status.

Default: null.

tags · array[string] | null

Filter by tag IDs or refs (AND logic).

Default: null.

updated_after · string | null

Filter cases updated after this time.

Default: null.

updated_before · string | null

Filter cases updated before this time.

Default: null.

Examples

Search cases

- ref: search_cases
  action: core.cases.search_cases
  args:
    search_term: phishing
    status:
      - new
      - in_progress
    limit: 25

core.cases.list_case_events

List all events for a case in chronological order.

Inputs

case_id · string · required

The ID of the case to get events for.

Examples

List case events

- ref: list_case_events
  action: core.cases.list_case_events
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.assign_user

Assign a user to an existing case.

Inputs

assignee_id · string · required

The ID of the user to assign to the case.

case_id · string · required

The ID of the case to assign a user to.

Examples

Assign a user by ID

- ref: assign_user
  action: core.cases.assign_user
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_id: ${{ TRIGGER.assignee_id }}

core.cases.assign_user_by_email

Assign a user to an existing case by email.

Inputs

assignee_email · string · required

The email of the user to assign to the case.

case_id · string · required

The ID of the case to assign a user to.

Examples

Assign a user by email

- ref: assign_user_by_email
  action: core.cases.assign_user_by_email
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_email: [e-mail]

core.cases.add_case_tag

Add a tag to a case by tag ID or ref.

Inputs

case_id · string · required

The ID of the case to add a tag to.

tag · string · required

The tag identifier (ID or ref) to add to the case.

create_if_missing · boolean

If true, create the tag if it does not exist.

Default: false.

Examples

Add a case tag

- ref: add_case_tag
  action: core.cases.add_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: credential-theft
    create_if_missing: true

core.cases.remove_case_tag

Remove a tag from a case by tag ID or ref.

Inputs

case_id · string · required

The ID of the case to remove a tag from.

tag · string · required

The tag identifier (ID or ref) to remove from the case.

Examples

Remove a case tag

- ref: remove_case_tag
  action: core.cases.remove_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: needs-triage

core.cases.delete_case

Delete a case.

Inputs

case_id · string · required

The ID of the case to delete.

Examples

Delete a case

- ref: delete_case
  action: core.cases.delete_case
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.create_comment

Add a comment to an existing case.

Inputs

case_id · string · required

The ID of the case to comment on.

content · string · required

The comment content.

parent_id · string | null

The ID of the parent comment if this is a reply.

Default: null.

workflow_id · string | null

The ID of the workflow to run when the comment is created.

Default: null.

Examples

Create a comment

- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."

core.cases.reply_to_comment

Reply to a top-level case comment.

Inputs

case_id · string · required

The ID of the case containing the parent comment.

content · string · required

The reply content.

parent_comment_id · string · required

The ID of the top-level comment to reply to.

Examples

Reply to a comment

- ref: reply_to_comment
  action: core.cases.reply_to_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ TRIGGER.comment_id }}
    content: "Added IOC context."

core.cases.update_comment

Update an existing case comment.

Inputs

comment_id · string · required

The ID of the comment to update.

content · string · required

The updated comment content.

Examples

Update a comment

- ref: update_comment
  action: core.cases.update_comment
  args:
    comment_id: ${{ TRIGGER.comment_id }}
    content: "Initial triage started. Waiting on endpoint data."

core.cases.list_comments

List all comments for a case.

Inputs

case_id · string · required

The ID of the case to get comments for.

Examples

List comments

- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.list_comment_threads

List comment threads for a case.

Inputs

case_id · string · required

The ID of the case to get comment threads for.

Examples

List comment threads

- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.get_comment_thread

Get the full thread for a comment ID.

Inputs

comment_id · string · required

The ID of a comment within the thread.

Examples

Get a comment thread

- ref: get_comment_thread
  action: core.cases.get_comment_thread
  args:
    comment_id: ${{ TRIGGER.comment_id }}

core.cases.upload_attachment

Upload a file attachment to a case.

Inputs

case_id · string · required

The ID of the case to attach the file to.

content_base64 · string · required

The file content encoded in base64.

content_type · string · required

The MIME type of the file (e.g., ‘application/pdf’).

file_name · string · required

The original filename.

Examples

Upload an attachment

- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain

core.cases.upload_attachment_from_url

Upload a file attachment to a case from a URL.

Inputs

case_id · string · required

The ID of the case to attach the file to.

url · string · required

The URL of the file to upload.

file_name · string | null

Filename of the file to upload. If not provided, the filename will be inferred from the URL.

Default: null.

headers · map[string, string] | null

The headers to use when downloading the file.

Default: null.

Examples

Upload an attachment from a URL

- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json

core.cases.list_attachments

List all attachments for a case.

Inputs

case_id · string · required

The ID of the case to list attachments for.

Examples

List attachments

- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.get_attachment

Get attachment metadata without downloading the content.

Inputs

attachment_id · string · required

The ID of the attachment to get.

case_id · string · required

The ID of the case containing the attachment.

Examples

Get attachment metadata

- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

core.cases.get_attachment_download_url

Get a presigned S3 URL for downloading an attachment.

Inputs

attachment_id · string · required

The ID of the attachment.

case_id · string · required

The ID of the case containing the attachment.

expiry · integer | null

URL expiry time in seconds. If not provided, uses the default from configuration.

Default: null.

Examples

Get an attachment download URL

- ref: get_attachment_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900

core.cases.download_attachment

Download an attachment’s content.

Inputs

attachment_id · string · required

The ID of the attachment to download.

case_id · string · required

The ID of the case containing the attachment.

Examples

Download an attachment

- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

core.cases.delete_attachment

Delete an attachment from a case.

Inputs

attachment_id · string · required

The ID of the attachment to delete.

case_id · string · required

The ID of the case containing the attachment.

Examples

Delete an attachment

- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

core.cases.create_task

Create a new task for a case.

Enterprise Edition

Inputs

case_id · string · required

The ID of the case to create a task for.

title · string · required

The title of the task.

assignee_id · string | null

The ID of the user to assign the task to.

Default: null.

default_trigger_values · object | null

The default trigger values for the task.

Default: null.

description · string | null

The description of the task.

Default: null.

priority · string

The priority of the task (unknown, low, medium, high, critical).

Default: "unknown".

status · string

The status of the task (todo, in_progress, blocked, completed).

Default: "todo".

workflow_id · string | null

The ID of the workflow associated with this task.

Default: null.

Examples

Create a task

- ref: create_task
  action: core.cases.create_task
  args:
    case_id: ${{ TRIGGER.case_id }}
    title: Collect email headers
    description: Pull the original message from the mail gateway.
    priority: high
    status: todo

core.cases.get_task

Get a specific case task by ID.

Enterprise Edition

Inputs

task_id · string · required

The ID of the task to retrieve.

Examples

Get a task

- ref: get_task
  action: core.cases.get_task
  args:
    task_id: ${{ TRIGGER.task_id }}

core.cases.list_tasks

List all tasks for a case.

Enterprise Edition

Inputs

case_id · string · required

The ID of the case to list tasks for.

Examples

List tasks

- ref: list_tasks
  action: core.cases.list_tasks
  args:
    case_id: ${{ TRIGGER.case_id }}

core.cases.update_task

Update an existing case task.

Enterprise Edition

Inputs

task_id · string · required

The ID of the task to update.

assignee_id · string | null

The ID of the user to assign the task to.

Default: null.

default_trigger_values · object | null

The default trigger values for the task.

Default: null.

description · string | null

The updated description of the task.

Default: null.

priority · string | null

The updated priority of the task (unknown, low, medium, high, critical).

Default: null.

status · string | null

The updated status of the task (todo, in_progress, blocked, completed).

Default: null.

title · string | null

The updated title of the task.

Default: null.

workflow_id · string | null

The ID of the workflow associated with this task.

Default: null.

Examples

Update a task

- ref: update_task
  action: core.cases.update_task
  args:
    task_id: ${{ TRIGGER.task_id }}
    status: in_progress

core.cases.delete_task

Delete a case task.

Enterprise Edition

Inputs

task_id · string · required

The ID of the task to delete.

Examples

Delete a task

- ref: delete_task
  action: core.cases.delete_task
  args:
    task_id: ${{ TRIGGER.task_id }}

core.cases.link_row

Link an existing table row to a case.

Enterprise Edition

Inputs

case_id · string · required

Case ID

row_id · string · required

Row ID

table_id · string · required

Table ID

Examples

Link a table row

- ref: link_row
  action: core.cases.link_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

core.cases.unlink_row

Remove a linked table row from a case.

Enterprise Edition

Inputs

case_id · string · required

Case ID

row_id · string · required

Row ID

table_id · string · required

Table ID

Examples

Unlink a table row

- ref: unlink_row
  action: core.cases.unlink_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

core.cases.insert_row

Insert a row into a table and link it to a case.

Enterprise Edition

Linked rows use regular tables. Create the destination table with the same columns schema documented in Tables.

Inputs

case_id · string · required

Case ID

row · object · required

Row values

table_id · string · required

Table ID

Examples

Insert and link a table row

- ref: insert_case_row
  action: core.cases.insert_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row:
      value: ${{ TRIGGER.indicator }}
      indicator_type: domain

core.cases.get_case_metrics

Get case metrics as OTEL-aligned time-series for the provided case IDs.

Enterprise Edition

Inputs

case_ids · array[string] · required

List of case IDs to get case metrics for.

Examples

Read case metrics

- ref: case_metrics
  action: core.cases.get_case_metrics
  args:
    case_ids:
      - ${{ TRIGGER.case_id }}
      - ${{ TRIGGER.related_case_id }}