Documentation Index
Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
Use this file to discover all available pages before exploring further.
Linked rows use regular tables.
When you create a table for case-linked evidence, use the same columns JSON schema documented in Tables and Table actions.
core.cases.link_row
Link an existing table row to a case.
Examples
Link table rows to a case
- ref: link_row
action: core.cases.link_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: unlink_row
action: core.cases.unlink_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: insert_case_row
action: core.cases.insert_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row:
value: ${{ TRIGGER.indicator }}
indicator_type: domain
core.cases.unlink_row
Remove a linked table row from a case.
Examples
Link table rows to a case
- ref: link_row
action: core.cases.link_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: unlink_row
action: core.cases.unlink_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: insert_case_row
action: core.cases.insert_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row:
value: ${{ TRIGGER.indicator }}
indicator_type: domain
core.cases.insert_row
Insert a row into a table and link it to a case.
Examples
Link table rows to a case
- ref: link_row
action: core.cases.link_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: unlink_row
action: core.cases.unlink_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row_id: ${{ TRIGGER.row_id }}
- ref: insert_case_row
action: core.cases.insert_row
args:
case_id: ${{ TRIGGER.case_id }}
table_id: indicators
row:
value: ${{ TRIGGER.indicator }}
indicator_type: domain
