Case management

Cases give you a shared place to triage, investigate, and resolve work. You can use them to keep status, evidence, comments, and follow-up work together in one record.

Features

Cases

Create, update, search, assign, tag, and delete cases.

Comments

Add comments, replies, and thread lookups.

Attachments

Upload, list, download, and delete case attachments.

Tasks

EE Add todo items with attachable workflows.

Linked rows

EE Link structured data to cases.

Metrics

EE Track custom case metrics.

Working with cases

Use a case when you need a durable investigation record instead of a single workflow run. Your workflows can create or update a case, attach evidence, add comments, and move the case forward as new context arrives.

Track the current owner, severity, priority, and status in one place
Add comments and replies so analysts and workflows share the same timeline
Store evidence as attachments instead of passing large blobs between actions
Link structured rows, tasks, and metrics to keep investigation context organized

How to trigger workflows from cases

Enterprise

Type / in a case comment and select a published workflow. See Comment triggers to run it from the comment.
Set a workflow on a case task and start it from the task. See Case tasks for task setup and Task triggers for the trigger payload.
Run a workflow automatically when a case event occurs. See Case triggers to select events and tag filters.

An agent can also call a workflow as a tool. When you need fixed order, deterministic branching, or guaranteed steps, use / or start the workflow from a task instead of asking an agent to run it.

How to chat with agents from cases

Mention a preset agent

Enterprise Type @ in a comment to have a preset agent investigate the case and reply in the thread. See Mention agents in case comments to configure access and follow the run.

Use the in-case copilot

Open source Use the copilot inside a case to summarize activity and draft next steps. It draws from the case timeline, linked evidence, and workflow output.

Correlate across cases

Enterprise Enterprise extends the copilot beyond a single case. Use it to correlate related cases, compare investigation history, and surface patterns across incidents.

Correlate repeated alerts across multiple cases
Spot shared indicators, assets, or actors
Find similar investigations before you start a new one
Build broader investigation context across your case queue

Custom fields

Custom fields let you store case-specific data that does not fit into the default case properties. You can use them for values such as ticket IDs, affected systems, request metadata, or triage notes.

Use custom fields when you need flexible structured data on a case. Your workflows can read and update them through the fields input on case actions. Case custom fields use the same storage type family as tables: TEXT, INTEGER, NUMERIC, BOOLEAN, DATE, TIMESTAMPTZ, JSONB, SELECT, and MULTI_SELECT. In the case field picker, raw JSONB is currently surfaced through the case-only URL kind, and the picker also exposes Long text, which is layered on top of TEXT.

Dropdowns

Enterprise Dropdowns add custom top-level case filters alongside built-in filters such as status, priority, and severity. You can use them to add workspace-specific classifications such as queue, business unit, incident type, or escalation path.

Unlike free-form fields, dropdowns give you a fixed set of options. This makes them useful when you want consistent filtering, routing, and reporting across your case queue.

Durations

Enterprise Durations track elapsed time between case events. You can use them to measure intervals such as time to triage, time to assign, or time to resolution.

Durations help you understand how cases move through your process. They are useful when you want operational reporting or workflow triggers based on how long a case has been in a given state.

Tasks

Enterprise See Case tasks to assign follow-up work, track completion, and start workflows from a task.

Linked rows

Enterprise Linked rows connect a case to structured data in tables. Use them when a case needs more than free-form notes, such as indicators, assets, or external detections.

Each linked table renders as its own grid in the case’s Tables tab, 20 rows at a time; page with the arrows in the table header. To link rows from the case page:

Open the Tables tab

Open the case and select the Tables tab.

Pick a table and rows

Click Link table, choose a table, and tick the rows to link. Your selection is kept while you page through the table or switch to another table, so you can pick rows from several tables at once.

Add the rows

Click Add rows. Tracecat skips rows that are already linked to the case.

To link more rows from a table that is already linked, click Add rows on that table’s grid. To unlink rows, tick them in the grid and click Unlink. A case can link up to 250 rows from each table and rows from up to 10 tables. Each link or unlink request takes at most 100 row IDs. For example, you can link:

Related SIEM alerts
Indicators of compromise (IoCs)
Affected assets such as hosts, users, or devices
Threat intelligence matches
Evidence artifacts such as domains, IPs, or hashes

Linked rows are especially useful when workflows enrich a case over time. You can insert new rows as evidence arrives or link existing rows that are already part of another workflow or lookup table. Linked rows use regular tables. When you create a table for case-linked evidence, use the same columns JSON schema documented in Tables and Table actions.

Case actions

Use core.cases.* actions when you want your workflows to create or update cases. Case descriptions and comments support Markdown whether you write them in the case UI or pass them to an action. Use the description input for case descriptions and the content input for comments and replies. You can include standard Markdown formatting, Markdown tables, and Mermaid diagrams. To add a diagram, wrap valid Mermaid syntax in a fenced code block labeled mermaid. Each group of case actions has its own reference page:

Cases to create, fetch, update, search, and delete cases, assign users, apply tags, and read metrics
Comments to add, reply to, update, and list comments and comment threads
Attachments to upload, list, download, and delete case attachments
Tasks to create, update, and list case tasks
Linked rows to link table rows to a case and read them back

For example:

- ref: create_case
  action: core.cases.create_case
  args:
    summary: "Investigate alert ${{ TRIGGER.alert_id }}"
    description: |
      ## Initial findings

      | Check | Result |
      | --- | --- |
      | Endpoint | Isolated |
      | Credentials | Reset required |
    priority: high
    severity: high
    tags:
      - triage
- ref: add_triage_note
  action: core.cases.create_comment
  args:
    case_id: ${{ ACTIONS.create_case.result.id }}
    content: |
      ```mermaid
      flowchart LR
        Alert --> Triage
        Triage --> Containment
      ```

Overview

Building automations

Resolve cases

Building agents

Building custom integrations

Self-hosting

Manage platform

Authentication

Security

Features

Cases

Comments

Attachments

Tasks

Linked rows

Metrics

Working with cases

How to trigger workflows from cases