Cases - Tracecat Docs

`core.cases.create_case`

Create a new case.

Inputs

description

string

required

The description of the case.

summary

string

required

The summary of the case.

create_missing_tags

boolean

If true, create any tags that do not already exist.Default: false.

Dropdown selections to set on the case. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).Default: null.

fields

object | null

Custom fields for the case.Default: null.

payload

object | null

Payload for the case.Default: null.

priority

string

The priority of the case.Default: "unknown".Allowed values: unknown, low, medium, high, critical, other.

severity

string

The severity of the case.Default: "unknown".Allowed values: unknown, informational, low, medium, high, critical, fatal, other.

status

string

The status of the case.Default: "unknown".Allowed values: unknown, new, in_progress, on_hold, resolved, closed, other.

Examples

Create a case

- ref: create_case
  action: core.cases.create_case
  args:
    summary: "Investigate alert ${{ TRIGGER.alert_id }}"
    description: "Created from workflow trigger."
    priority: high
    severity: high
    tags:
      - phishing

`core.cases.get_case`

Get details of a specific case by ID.

Inputs

case_id

string

required

The ID of the case to retrieve.

Examples

Get a case

- ref: get_case
  action: core.cases.get_case
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.update_case`

Update an existing case.

Inputs

case_id

string

required

The ID of the case to update.

append

boolean

If true, append the provided description to the existing description when it is not empty.Default: false.

create_missing_tags

boolean

If true, create any tags that do not already exist.Default: false.

description

string | null

The updated description of the case.Default: null.

Dropdown selections to set or clear. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).Default: null.

fields

object | null

Updated custom fields for the case.Default: null.

payload

object | null

Updated payload for the case.Default: null.

priority

string | null

The updated priority of the case.Default: null.

severity

string | null

The updated severity of the case.Default: null.

status

string | null

The updated status of the case.Default: null.

summary

string | null

The updated summary of the case.Default: null.

Examples

Update case fields

- ref: update_case
  action: core.cases.update_case
  args:
    case_id: ${{ TRIGGER.case_id }}
    status: in_progress
    priority: critical
    append: true
    description: |
      Analyst note:
      - Escalated after credential theft indicators were confirmed.

`core.cases.list_cases`

List all cases.

Inputs

cursor

string | null

Pagination cursor used to fetch a specific page when paginate=true.Default: null.

limit

integer

Maximum number of cases to return.Default: 100.

order_by

string | null

The field to order the cases by.Default: null.

paginate

boolean

If true, return cursor pagination metadata along with items.Default: false.

reverse

boolean

Reverse pagination direction when paginate=true.Default: false.

sort

string | null

The direction to order the cases by.Default: null.

Examples

List cases

- ref: list_cases
  action: core.cases.list_cases
  args:
    limit: 25
    order_by: updated_at
    sort: desc

`core.cases.search_cases`

Search cases based on various criteria.

Inputs

assignee_id

string | array[string] | null

Filter by assignee ID or ‘unassigned’.Default: null.

cursor

string | null

Pagination cursor used to fetch a specific page when paginate=true.Default: null.

Filter by dropdown values in definition_ref:option_ref format.Default: null.

end_time

string | null

Filter cases created before this time.Default: null.

limit

integer

Maximum number of cases to return.Default: 100.

order_by

string | null

The field to order the cases by.Default: null.

paginate

boolean

If true, return cursor pagination metadata along with items.Default: false.

priority

string | array[string] | null

Filter by case priority.Default: null.

reverse

boolean

Reverse pagination direction when paginate=true.Default: false.

search_term

string | null

Text to search for in case summary and description.Default: null.

severity

string | array[string] | null

Filter by case severity.Default: null.

short_id

string | null

Filter by case short_id.Default: null.

sort

string | null

The direction to order the cases by.Default: null.

start_time

string | null

Filter cases created after this time.Default: null.

status

string | array[string] | null

Filter by case status.Default: null.

Examples

Search cases

- ref: search_cases
  action: core.cases.search_cases
  args:
    search_term: phishing
    status:
      - new
      - in_progress
    limit: 25

`core.cases.list_case_events`

List all events for a case in chronological order.

Inputs

case_id

string

required

The ID of the case to get events for.

Examples

List case events

- ref: list_case_events
  action: core.cases.list_case_events
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.assign_user`

Assign a user to an existing case.

Inputs

assignee_id

string

required

The ID of the user to assign to the case.

case_id

string

required

The ID of the case to assign a user to.

Examples

Assign a user by ID

- ref: assign_user
  action: core.cases.assign_user
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_id: ${{ TRIGGER.assignee_id }}

`core.cases.assign_user_by_email`

Assign a user to an existing case by email.

Inputs

assignee_email

string

required

The email of the user to assign to the case.

case_id

string

required

The ID of the case to assign a user to.

Examples

Assign a user by email

- ref: assign_user_by_email
  action: core.cases.assign_user_by_email
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_email: analyst@example.com

`core.cases.add_case_tag`

Add a tag to a case by tag ID or ref.

Inputs

case_id

string

required

The ID of the case to add a tag to.

tag

string

required

The tag identifier (ID or ref) to add to the case.

create_if_missing

boolean

If true, create the tag if it does not exist.Default: false.

Examples

Add a case tag

- ref: add_case_tag
  action: core.cases.add_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: credential-theft
    create_if_missing: true

`core.cases.remove_case_tag`

Remove a tag from a case by tag ID or ref.

Inputs

case_id

string

required

The ID of the case to remove a tag from.

tag

string

required

The tag identifier (ID or ref) to remove from the case.

Examples

Remove a case tag

- ref: remove_case_tag
  action: core.cases.remove_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: needs-triage

`core.cases.delete_case`

Delete a case.

Inputs

case_id

string

required

The ID of the case to delete.

Examples

Delete a case

- ref: delete_case
  action: core.cases.delete_case
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.create_comment`

Add a comment to an existing case.

Inputs

case_id

string

required

The ID of the case to comment on.

content

string

required

The comment content.

parent_id

string | null

The ID of the parent comment if this is a reply.Default: null.

workflow_id

string | null

The ID of the workflow to run when the comment is created.Default: null.

Examples

Create a comment

- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."

`core.cases.reply_to_comment`

Reply to a top-level case comment.

Inputs

case_id

string

required

The ID of the case containing the parent comment.

content

string

required

The reply content.

parent_comment_id

string

required

The ID of the top-level comment to reply to.

Examples

Reply to a comment

- ref: reply_to_comment
  action: core.cases.reply_to_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ TRIGGER.comment_id }}
    content: "Added IOC context."

`core.cases.update_comment`

Update an existing case comment.

Inputs

comment_id

string

required

The ID of the comment to update.

content

string

required

The updated comment content.

Examples

Update a comment

- ref: update_comment
  action: core.cases.update_comment
  args:
    comment_id: ${{ TRIGGER.comment_id }}
    content: "Initial triage started. Waiting on endpoint data."

`core.cases.list_comments`

List all comments for a case.

Inputs

case_id

string

required

The ID of the case to get comments for.

Examples

List comments

- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.list_comment_threads`

List comment threads for a case.

Inputs

case_id

string

required

The ID of the case to get comment threads for.

Examples

List comment threads

- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.get_comment_thread`

Get the full thread for a comment ID.

Inputs

comment_id

string

required

The ID of a comment within the thread.

Examples

Get a comment thread

- ref: get_comment_thread
  action: core.cases.get_comment_thread
  args:
    comment_id: ${{ TRIGGER.comment_id }}

`core.cases.upload_attachment`

Upload a file attachment to a case.

Inputs

case_id

string

required

The ID of the case to attach the file to.

content_base64

string

required

The file content encoded in base64.

content_type

string

required

The MIME type of the file (e.g., ‘application/pdf’).

file_name

string

required

The original filename.

Examples

Upload an attachment

- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain

`core.cases.upload_attachment_from_url`

Upload a file attachment to a case from a URL.

Inputs

case_id

string

required

The ID of the case to attach the file to.

url

string

required

The URL of the file to upload.

file_name

string | null

Filename of the file to upload. If not provided, the filename will be inferred from the URL.Default: null.

headers

map[string, string] | null

The headers to use when downloading the file.Default: null.

Examples

Upload an attachment from a URL

- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json

`core.cases.list_attachments`

List all attachments for a case.

Inputs

case_id

string

required

The ID of the case to list attachments for.

Examples

List attachments

- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.get_attachment`

Get attachment metadata without downloading the content.

Inputs

attachment_id

string

required

The ID of the attachment to get.

case_id

string

required

The ID of the case containing the attachment.

Examples

Get attachment metadata

- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.get_attachment_download_url`

Get a presigned S3 URL for downloading an attachment.

Inputs

attachment_id

string

required

The ID of the attachment.

case_id

string

required

The ID of the case containing the attachment.

expiry

integer | null

URL expiry time in seconds. If not provided, uses the default from configuration.Default: null.

Examples

Get an attachment download URL

- ref: get_attachment_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900

`core.cases.download_attachment`

Download an attachment’s content.

Inputs

attachment_id

string

required

The ID of the attachment to download.

case_id

string

required

The ID of the case containing the attachment.

Examples

Download an attachment

- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.delete_attachment`

Delete an attachment from a case.

Inputs

attachment_id

string

required

The ID of the attachment to delete.

case_id

string

required

The ID of the case containing the attachment.

Examples

Delete an attachment

- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.create_task`

Create a new task for a case. Enterprise Edition

Inputs

case_id

string

required

The ID of the case to create a task for.

title

string

required

The title of the task.

assignee_id

string | null

The ID of the user to assign the task to.Default: null.

default_trigger_values

object | null

The default trigger values for the task.Default: null.

description

string | null

The description of the task.Default: null.

priority

string

The priority of the task (unknown, low, medium, high, critical).Default: "unknown".

status

string

The status of the task (todo, in_progress, blocked, completed).Default: "todo".

workflow_id

string | null

The ID of the workflow associated with this task.Default: null.

Examples

Create a task

- ref: create_task
  action: core.cases.create_task
  args:
    case_id: ${{ TRIGGER.case_id }}
    title: Collect email headers
    description: Pull the original message from the mail gateway.
    priority: high
    status: todo

`core.cases.get_task`

Get a specific case task by ID. Enterprise Edition

Inputs

task_id

string

required

The ID of the task to retrieve.

Examples

Get a task

- ref: get_task
  action: core.cases.get_task
  args:
    task_id: ${{ TRIGGER.task_id }}

`core.cases.list_tasks`

List all tasks for a case. Enterprise Edition

Inputs

case_id

string

required

The ID of the case to list tasks for.

Examples

List tasks

- ref: list_tasks
  action: core.cases.list_tasks
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.update_task`

Update an existing case task. Enterprise Edition

Inputs

task_id

string

required

The ID of the task to update.

assignee_id

string | null

The ID of the user to assign the task to.Default: null.

default_trigger_values

object | null

The default trigger values for the task.Default: null.

description

string | null

The updated description of the task.Default: null.

priority

string | null

The updated priority of the task (unknown, low, medium, high, critical).Default: null.

status

string | null

The updated status of the task (todo, in_progress, blocked, completed).Default: null.

title

string | null

The updated title of the task.Default: null.

workflow_id

string | null

The ID of the workflow associated with this task.Default: null.

Examples

Update a task

- ref: update_task
  action: core.cases.update_task
  args:
    task_id: ${{ TRIGGER.task_id }}
    status: in_progress

`core.cases.delete_task`

Delete a case task. Enterprise Edition

Inputs

task_id

string

required

The ID of the task to delete.

Examples

Delete a task

- ref: delete_task
  action: core.cases.delete_task
  args:
    task_id: ${{ TRIGGER.task_id }}

`core.cases.link_row`

Link an existing table row to a case. Enterprise Edition

Inputs

case_id

string

required

Case ID

row_id

string

required

Row ID

table_id

string

required

Table ID

Examples

Link a table row

- ref: link_row
  action: core.cases.link_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

`core.cases.unlink_row`

Remove a linked table row from a case. Enterprise Edition

Inputs

case_id

string

required

Case ID

row_id

string

required

Row ID

table_id

string

required

Table ID

Examples

Unlink a table row

- ref: unlink_row
  action: core.cases.unlink_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

`core.cases.insert_row`

Insert a row into a table and link it to a case. Enterprise Edition

Linked rows use regular tables. Create the destination table with the same columns schema documented in Tables.

Inputs

case_id

string

required

Case ID

row

object

required

Row values

table_id

string

required

Table ID

Examples

Insert and link a table row

- ref: insert_case_row
  action: core.cases.insert_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row:
      value: ${{ TRIGGER.indicator }}
      indicator_type: domain

`core.cases.get_case_metrics`

Get case metrics as OTEL-aligned time-series for the provided case IDs. Enterprise Edition

Inputs

case_ids

array[string]

required

List of case IDs to get case metrics for.

Examples

Read case metrics

- ref: case_metrics
  action: core.cases.get_case_metrics
  args:
    case_ids:
      - ${{ TRIGGER.case_id }}
      - ${{ TRIGGER.related_case_id }}

​core.cases.create_case

​Inputs

​Examples

​core.cases.get_case

​Inputs

​Examples

​core.cases.update_case

​Inputs

​Examples

​core.cases.list_cases

​Inputs

​Examples

​core.cases.search_cases

​Inputs

​Examples

​core.cases.list_case_events

​Inputs

​Examples

​core.cases.assign_user

​Inputs

​Examples

​core.cases.assign_user_by_email

​Inputs

​Examples

​core.cases.add_case_tag

​Inputs

​Examples

​core.cases.remove_case_tag

​Inputs

​Examples

​core.cases.delete_case

​Inputs

​Examples

​core.cases.create_comment

​Inputs

​Examples

​core.cases.reply_to_comment

​Inputs

​Examples

​core.cases.update_comment

​Inputs

​Examples

​core.cases.list_comments

​Inputs

​Examples

​core.cases.list_comment_threads

​Inputs

​Examples

​core.cases.get_comment_thread

​Inputs

​Examples

​core.cases.upload_attachment

​Inputs

​Examples

​core.cases.upload_attachment_from_url

​Inputs

​Examples

​core.cases.list_attachments

​Inputs

​Examples

​core.cases.get_attachment

​Inputs

​Examples

​core.cases.get_attachment_download_url

​Inputs

​Examples

​core.cases.download_attachment

​Inputs

​Examples

​core.cases.delete_attachment

​Inputs

​Examples

​core.cases.create_task

​Inputs

​Examples

​core.cases.get_task

​Inputs

​Examples

​core.cases.list_tasks

​Inputs

`core.cases.create_case`

Inputs

Examples

`core.cases.get_case`

Inputs

Examples

`core.cases.update_case`

Inputs

Examples

`core.cases.list_cases`

Inputs

Examples

`core.cases.search_cases`

Inputs

Examples

`core.cases.list_case_events`

Inputs

Examples

`core.cases.assign_user`

Inputs

Examples

`core.cases.assign_user_by_email`

Inputs

Examples

`core.cases.add_case_tag`

Inputs

Examples

`core.cases.remove_case_tag`

Inputs

Examples

`core.cases.delete_case`

Inputs

Examples

`core.cases.create_comment`

Inputs

Examples

`core.cases.reply_to_comment`

Inputs

Examples

`core.cases.update_comment`

Inputs

Examples

`core.cases.list_comments`

Inputs

Examples

`core.cases.list_comment_threads`

Inputs

Examples

`core.cases.get_comment_thread`

Inputs

Examples

`core.cases.upload_attachment`

Inputs

Examples

`core.cases.upload_attachment_from_url`

Inputs

Examples

`core.cases.list_attachments`

Inputs

Examples

`core.cases.get_attachment`

Inputs

Examples

`core.cases.get_attachment_download_url`

Inputs

Examples

`core.cases.download_attachment`

Inputs

Examples

`core.cases.delete_attachment`

Inputs

Examples

`core.cases.create_task`

Inputs

Examples

`core.cases.get_task`

Inputs

Examples

`core.cases.list_tasks`

Inputs