Correlations

Correlations show every other case that links the same table row. Use them to spot campaigns, repeat offenders, and shared infrastructure: if two cases link the same IP address row, the cases are related.

Correlations build on linked rows. Tracecat matches rows by row ID, so link the existing row instead of inserting a duplicate when the same indicator appears in a new case.

View related cases

Open the Tables tab

Open the case and select the Tables tab.

Right-click a row

Right-click a linked row and select View related cases.

Review the cases

The Related cases drawer shows the row’s data and every other case that links it. The current case is left out.

Each related case shows its short ID, summary, priority, severity, tags, and when it was created and updated. Hover a case to preview its status, assignee, tasks, dropdowns, and custom fields. Click a case to keep its preview open. Click Open case, or Ctrl-click or Cmd-click the case, to open it in a new tab. If more cases link the row, click Load more at the bottom of the list.

Correlate cases in workflows

Use core.cases.list_cases_by_row to find cases that link a row. Pass exclude_case_id to leave out the current case.

- ref: linked_rows
  action: core.cases.get_linked_case_rows
  args:
    case_id: ${{ TRIGGER.case_id }}

- ref: related_cases
  action: core.cases.list_cases_by_row
  args:
    table_id: ${{ ACTIONS.linked_rows.result[0].table_id }}
    row_id: ${{ ACTIONS.linked_rows.result[0].row_id }}
    exclude_case_id: ${{ TRIGGER.case_id }}

Combine it with a case trigger on table_row_linked to comment on or escalate a case as soon as an analyst or workflow links a row that already appears in other cases.

Case management

Build cases

Resolve cases

Correlations

Correlations

Correlate cases in workflows

​Correlations

​View related cases

​Correlate cases in workflows

​Related pages

Correlations

View related cases

Correlate cases in workflows

Related pages