> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Case management
> Track and resolve Tracecat cases: triage alerts, run agents and workflows on case events, manage tasks and comments, and report on outcomes.
Cases give you a shared place to triage, investigate, and resolve work.
You can use them to keep status, evidence, comments, and follow-up work together in one record.
## Features
Create, update, search, assign, tag, and delete cases.
Add comments, replies, and thread lookups.
Upload, list, download, and delete case attachments.
EE
Add todo items with attachable workflows.
EE
Link structured data to cases.
EE
Track custom case metrics.
## Working with cases
Use a case when you need a durable investigation record instead of a single workflow run.
Your workflows can create or update a case, attach evidence, add comments, and move the case forward as new context arrives.
* Track the current owner, severity, priority, and status in one place
* Add comments and replies so analysts and workflows share the same timeline
* Store evidence as attachments instead of passing large blobs between actions
* Link structured rows, tasks, and metrics to keep investigation context organized
## How to trigger workflows from cases
Enterprise
* Type `/` in a case comment and select a published workflow. See [Comment triggers](/automations/triggers/comment-triggers) to run it from the comment.
* Set a workflow on a case task and start it from the task. See [Case tasks](/automations/cases/tasks) for task setup and [Task triggers](/automations/triggers/task-triggers) for the trigger payload.
* Run a workflow automatically when a case event occurs. See [Case triggers](/automations/triggers/case-triggers) to select events and tag filters.
An agent can also call a workflow as a tool. When you need fixed order, deterministic branching, or guaranteed steps, use `/` or start the workflow from a task instead of asking an agent to run it.
## How to chat with agents from cases
### Mention a preset agent
Enterprise
Type `@` in a comment to have a preset agent investigate the case and reply in the thread. See [Mention agents in case comments](/automations/cases/agent-mentions) to configure access and follow the run.
### Use the in-case copilot
Open source
Use the copilot inside a case to summarize activity and draft next steps. It draws from the case timeline, linked evidence, and workflow output.
### Correlate across cases
Enterprise
Enterprise extends the copilot beyond a single case. Use it to correlate related cases, compare investigation history, and surface patterns across incidents.
* Correlate repeated alerts across multiple cases
* Spot shared indicators, assets, or actors
* Find similar investigations before you start a new one
* Build broader investigation context across your case queue
## Tags
Tags help you group and find related cases.
You can use them to label incidents by team, detection source, campaign, environment, or any other shared dimension.
Tags work well when you want lightweight organization across many cases.
You can also set tags from workflows with `core.cases.create_case` and `core.cases.update_case`.
## Custom fields
Custom fields let you store case-specific data that does not fit into the default case properties.
You can use them for values such as ticket IDs, affected systems, request metadata, or triage notes.
Use custom fields when you need flexible structured data on a case.
Your workflows can read and update them through the `fields` input on case actions.
Case custom fields use the same storage type family as tables: `TEXT`, `INTEGER`, `NUMERIC`, `BOOLEAN`, `DATE`, `TIMESTAMPTZ`, `JSONB`, `SELECT`, and `MULTI_SELECT`.
In the case field picker, raw `JSONB` is currently surfaced through the case-only `URL` kind, and the picker also exposes `Long text`, which is layered on top of `TEXT`.
## Dropdowns
Enterprise
Dropdowns add custom top-level case filters alongside built-in filters such as status, priority, and severity.
You can use them to add workspace-specific classifications such as queue, business unit, incident type, or escalation path.
Unlike free-form fields, dropdowns give you a fixed set of options.
This makes them useful when you want consistent filtering, routing, and reporting across your case queue.
## Durations
Enterprise
Durations track elapsed time between case events.
You can use them to measure intervals such as time to triage, time to assign, or time to resolution.
Durations help you understand how cases move through your process.
They are useful when you want operational reporting or workflow triggers based on how long a case has been in a given state.
## Tasks
Enterprise
See [Case tasks](/automations/cases/tasks) to assign follow-up work, track completion, and start workflows from a task.
## Linked rows
Enterprise
Linked rows connect a case to structured data in tables.
Use them when a case needs more than free-form notes, such as indicators, assets, or external detections.
Each linked table renders as its own grid in the case's Tables tab, 20 rows at a time; page with the arrows in the table header. To link rows from the case page:
Open the case and select the Tables tab.
Click `Link table`, choose a table, and tick the rows to link.
Your selection is kept while you page through the table or switch to another table, so you can pick rows from several tables at once.
Click `Add rows`. Tracecat skips rows that are already linked to the case.
To link more rows from a table that is already linked, click `Add rows` on that table's grid. To unlink rows, tick them in the grid and click `Unlink`.
A case can link up to 250 rows from each table and rows from up to 10 tables. Each link or unlink request takes at most 100 row IDs.
For example, you can link:
* Related SIEM alerts
* Indicators of compromise (IoCs)
* Affected assets such as hosts, users, or devices
* Threat intelligence matches
* Evidence artifacts such as domains, IPs, or hashes
Linked rows are especially useful when workflows enrich a case over time.
You can insert new rows as evidence arrives or link existing rows that are already part of another workflow or lookup table.
Linked rows use regular tables.
When you create a table for case-linked evidence, use the same `columns` JSON schema documented in [Tables](/automations/tables) and [Table actions](/automations/core-actions/memory-actions/tables).
## Case actions
Use `core.cases.*` actions when you want your workflows to create or update cases.
Case descriptions and comments support Markdown whether you write them in the case UI or pass them to an action.
Use the `description` input for case descriptions and the `content` input for comments and replies.
You can include standard Markdown formatting, Markdown tables, and Mermaid diagrams.
To add a diagram, wrap valid Mermaid syntax in a fenced code block labeled `mermaid`.
Each group of case actions has its own reference page:
* [Cases](/automations/core-actions/case-actions/cases) to create, fetch, update, search, and delete cases, assign users, apply tags, and read metrics
* [Comments](/automations/core-actions/case-actions/comments) to add, reply to, update, and list comments and comment threads
* [Attachments](/automations/core-actions/case-actions/attachments) to upload, list, download, and delete case attachments
* [Tasks](/automations/core-actions/case-actions/tasks) to create, update, and list case tasks
* [Linked rows](/automations/core-actions/case-actions/linked-rows) to link table rows to a case and read them back
For example:
````yaml theme={null}
- ref: create_case
action: core.cases.create_case
args:
summary: "Investigate alert ${{ TRIGGER.alert_id }}"
description: |
## Initial findings
| Check | Result |
| --- | --- |
| Endpoint | Isolated |
| Credentials | Reset required |
priority: high
severity: high
tags:
- triage
- ref: add_triage_note
action: core.cases.create_comment
args:
case_id: ${{ ACTIONS.create_case.result.id }}
content: |
```mermaid
flowchart LR
Alert --> Triage
Triage --> Containment
```
````