Skip to main content

​
core.cases.create_comment

Add a comment to an existing case.

​
Inputs

​
case_id
string
required
The ID of the case to comment on.
​
content
string
required
The comment content.
​
parent_id
string | null
The ID of the parent comment if this is a reply.Default: null.
​
workflow_id
string | null
The ID of the workflow to run when the comment is created.Default: null.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}

​
core.cases.reply_to_comment

Reply to a top-level case comment.

​
Inputs

​
case_id
string
required
The ID of the case containing the parent comment.
​
content
string
required
The reply content.
​
parent_comment_id
string
required
The ID of the top-level comment to reply to.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}

​
core.cases.update_comment

Update an existing case comment.

​
Inputs

​
comment_id
string
required
The ID of the comment to update.
​
content
string
required
The updated comment content.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}

​
core.cases.list_comments

List all comments for a case.

​
Inputs

​
case_id
string
required
The ID of the case to get comments for.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}

​
core.cases.list_comment_threads

List comment threads for a case.

​
Inputs

​
case_id
string
required
The ID of the case to get comment threads for.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}

​
core.cases.get_comment_thread

Get the full thread for a comment ID.

​
Inputs

​
comment_id
string
required
The ID of a comment within the thread.

​
Examples

Manage case comments 
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}