Cases - Tracecat Docs

`core.cases.create_case`

Create a new case.

Inputs

string

required

The description of the case.

string

required

The summary of the case.

boolean

If true, create any tags that do not already exist.Default: false.

Dropdown selections to set on the case. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).Default: null.

object | null

Custom fields for the case.Default: null.

object | null

Payload for the case.Default: null.

string

The priority of the case.Default: "unknown".Allowed values: unknown, low, medium, high, critical, other.

string

The severity of the case.Default: "unknown".Allowed values: unknown, informational, low, medium, high, critical, fatal, other.

string

The status of the case.Default: "unknown".Allowed values: unknown, new, in_progress, on_hold, resolved, closed, other.

array[string] | null

List of tag identifiers (IDs or refs) to add to the case.Default: null.

Examples

Create a case

- ref: create_case
  action: core.cases.create_case
  args:
    summary: "Investigate alert ${{ TRIGGER.alert_id }}"
    description: "Created from workflow trigger."
    priority: high
    severity: high
    tags:
      - phishing

`core.cases.get_case`

Get details of a specific case by ID.

Inputs

string

required

The ID of the case to retrieve.

Examples

Get a case

- ref: get_case
  action: core.cases.get_case
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.update_case`

Update an existing case.

Inputs

string

required

The ID of the case to update.

boolean

If true, append the provided description to the existing description when it is not empty.Default: false.

boolean

If true, create any tags that do not already exist.Default: false.

string | null

The updated description of the case.Default: null.

Dropdown selections to set or clear. Each item must include either definition_id or definition_ref, and either option_id or option_ref (or null to clear).Default: null.

object | null

Updated custom fields for the case.Default: null.

object | null

Updated payload for the case.Default: null.

string | null

The updated priority of the case.Default: null.

string | null

The updated severity of the case.Default: null.

string | null

The updated status of the case.Default: null.

string | null

The updated summary of the case.Default: null.

array[string] | null

List of tag identifiers (IDs or refs) to set on the case. This will replace all existing tags.Default: null.

Examples

Update case fields

- ref: update_case
  action: core.cases.update_case
  args:
    case_id: ${{ TRIGGER.case_id }}
    status: in_progress
    priority: critical
    append: true
    description: |
      Analyst note:
      - Escalated after credential theft indicators were confirmed.

`core.cases.list_cases`

List all cases.

Inputs

string | null

Pagination cursor used to fetch a specific page when paginate=true.Default: null.

integer

Maximum number of cases to return.Default: 100.

string | null

The field to order the cases by.Default: null.

boolean

If true, return cursor pagination metadata along with items.Default: false.

boolean

Reverse pagination direction when paginate=true.Default: false.

string | null

The direction to order the cases by.Default: null.

Examples

List cases

- ref: list_cases
  action: core.cases.list_cases
  args:
    limit: 25
    order_by: updated_at
    sort: desc

`core.cases.search_cases`

Search cases based on various criteria.

Inputs

string | array[string] | null

Filter by assignee ID or ‘unassigned’.Default: null.

string | null

Pagination cursor used to fetch a specific page when paginate=true.Default: null.

Filter by dropdown values in definition_ref:option_ref format.Default: null.

string | null

Filter cases created before this time.Default: null.

integer

Maximum number of cases to return.Default: 100.

string | null

The field to order the cases by.Default: null.

boolean

If true, return cursor pagination metadata along with items.Default: false.

string | array[string] | null

Filter by case priority.Default: null.

boolean

Reverse pagination direction when paginate=true.Default: false.

string | null

Text to search for in case summary and description.Default: null.

string | array[string] | null

Filter by case severity.Default: null.

string | null

Filter by case short_id.Default: null.

string | null

The direction to order the cases by.Default: null.

string | null

Filter cases created after this time.Default: null.

string | array[string] | null

Filter by case status.Default: null.

array[string] | null

Filter by tag IDs or refs (AND logic).Default: null.

string | null

Filter cases updated after this time.Default: null.

string | null

Filter cases updated before this time.Default: null.

Examples

Search cases

- ref: search_cases
  action: core.cases.search_cases
  args:
    search_term: phishing
    status:
      - new
      - in_progress
    limit: 25

`core.cases.list_case_events`

List all events for a case in chronological order.

Inputs

string

required

The ID of the case to get events for.

Examples

List case events

- ref: list_case_events
  action: core.cases.list_case_events
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.assign_user`

Assign a user to an existing case.

Inputs

string

required

The ID of the user to assign to the case.

string

required

The ID of the case to assign a user to.

Examples

Assign a user by ID

- ref: assign_user
  action: core.cases.assign_user
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_id: ${{ TRIGGER.assignee_id }}

`core.cases.assign_user_by_email`

Assign a user to an existing case by email.

Inputs

string

required

The email of the user to assign to the case.

string

required

The ID of the case to assign a user to.

Examples

Assign a user by email

- ref: assign_user_by_email
  action: core.cases.assign_user_by_email
  args:
    case_id: ${{ TRIGGER.case_id }}
    assignee_email: analyst@example.com

`core.cases.add_case_tag`

Add a tag to a case by tag ID or ref.

Inputs

string

required

The ID of the case to add a tag to.

string

required

The tag identifier (ID or ref) to add to the case.

boolean

If true, create the tag if it does not exist.Default: false.

Examples

Add a case tag

- ref: add_case_tag
  action: core.cases.add_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: credential-theft
    create_if_missing: true

`core.cases.remove_case_tag`

Remove a tag from a case by tag ID or ref.

Inputs

string

required

The ID of the case to remove a tag from.

string

required

The tag identifier (ID or ref) to remove from the case.

Examples

Remove a case tag

- ref: remove_case_tag
  action: core.cases.remove_case_tag
  args:
    case_id: ${{ TRIGGER.case_id }}
    tag: needs-triage

`core.cases.delete_case`

Delete a case.

Inputs

string

required

The ID of the case to delete.

Examples

Delete a case

- ref: delete_case
  action: core.cases.delete_case
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.create_comment`

Add a comment to an existing case.

Inputs

string

required

The ID of the case to comment on.

string

required

The comment content.

string | null

The ID of the parent comment if this is a reply.Default: null.

string | null

The ID of the workflow to run when the comment is created.Default: null.

Examples

Create a comment

- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."

`core.cases.reply_to_comment`

Reply to a top-level case comment.

Inputs

string

required

The ID of the case containing the parent comment.

string

required

The reply content.

string

required

The ID of the top-level comment to reply to.

Examples

Reply to a comment

- ref: reply_to_comment
  action: core.cases.reply_to_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ TRIGGER.comment_id }}
    content: "Added IOC context."

`core.cases.update_comment`

Update an existing case comment.

Inputs

string

required

The ID of the comment to update.

string

required

The updated comment content.

Examples

Update a comment

- ref: update_comment
  action: core.cases.update_comment
  args:
    comment_id: ${{ TRIGGER.comment_id }}
    content: "Initial triage started. Waiting on endpoint data."

`core.cases.list_comments`

List all comments for a case.

Inputs

string

required

The ID of the case to get comments for.

Examples

List comments

- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.list_comment_threads`

List comment threads for a case.

Inputs

string

required

The ID of the case to get comment threads for.

Examples

List comment threads

- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.get_comment_thread`

Get the full thread for a comment ID.

Inputs

string

required

The ID of a comment within the thread.

Examples

Get a comment thread

- ref: get_comment_thread
  action: core.cases.get_comment_thread
  args:
    comment_id: ${{ TRIGGER.comment_id }}

`core.cases.upload_attachment`

Upload a file attachment to a case.

Inputs

string

required

The ID of the case to attach the file to.

string

required

The file content encoded in base64.

string

required

The MIME type of the file (e.g., ‘application/pdf’).

string

required

The original filename.

Examples

Upload an attachment

- ref: upload_attachment
  action: core.cases.upload_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    file_name: note.txt
    content_base64: Zm9yZW5zaWMgbm90ZXM=
    content_type: text/plain

`core.cases.upload_attachment_from_url`

Upload a file attachment to a case from a URL.

Inputs

string

required

The ID of the case to attach the file to.

string

required

The URL of the file to upload.

string | null

Filename of the file to upload. If not provided, the filename will be inferred from the URL.Default: null.

map[string, string] | null

The headers to use when downloading the file.Default: null.

Examples

Upload an attachment from a URL

- ref: upload_attachment_from_url
  action: core.cases.upload_attachment_from_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    url: https://artifacts.example.com/evidence/${{ TRIGGER.alert_id }}
    headers:
      Authorization: Bearer ${{ SECRETS.artifacts.API_TOKEN }}
    file_name: evidence.json

`core.cases.list_attachments`

List all attachments for a case.

Inputs

string

required

The ID of the case to list attachments for.

Examples

List attachments

- ref: list_attachments
  action: core.cases.list_attachments
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.get_attachment`

Get attachment metadata without downloading the content.

Inputs

string

required

The ID of the attachment to get.

string

required

The ID of the case containing the attachment.

Examples

Get attachment metadata

- ref: get_attachment
  action: core.cases.get_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.get_attachment_download_url`

Get a presigned S3 URL for downloading an attachment.

Inputs

string

required

The ID of the attachment.

string

required

The ID of the case containing the attachment.

integer | null

URL expiry time in seconds. If not provided, uses the default from configuration.Default: null.

Examples

Get an attachment download URL

- ref: get_attachment_download_url
  action: core.cases.get_attachment_download_url
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}
    expiry: 900

`core.cases.download_attachment`

Download an attachment’s content.

Inputs

string

required

The ID of the attachment to download.

string

required

The ID of the case containing the attachment.

Examples

Download an attachment

- ref: download_attachment
  action: core.cases.download_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.delete_attachment`

Delete an attachment from a case.

Inputs

string

required

The ID of the attachment to delete.

string

required

The ID of the case containing the attachment.

Examples

Delete an attachment

- ref: delete_attachment
  action: core.cases.delete_attachment
  args:
    case_id: ${{ TRIGGER.case_id }}
    attachment_id: ${{ TRIGGER.attachment_id }}

`core.cases.create_task`

Create a new task for a case. Enterprise Edition

Inputs

string

required

The ID of the case to create a task for.

string

required

The title of the task.

string | null

The ID of the user to assign the task to.Default: null.

object | null

The default trigger values for the task.Default: null.

string | null

The description of the task.Default: null.

string

The priority of the task (unknown, low, medium, high, critical).Default: "unknown".

string

The status of the task (todo, in_progress, blocked, completed).Default: "todo".

string | null

The ID of the workflow associated with this task.Default: null.

Examples

Create a task

- ref: create_task
  action: core.cases.create_task
  args:
    case_id: ${{ TRIGGER.case_id }}
    title: Collect email headers
    description: Pull the original message from the mail gateway.
    priority: high
    status: todo

`core.cases.get_task`

Get a specific case task by ID. Enterprise Edition

Inputs

string

required

The ID of the task to retrieve.

Examples

Get a task

- ref: get_task
  action: core.cases.get_task
  args:
    task_id: ${{ TRIGGER.task_id }}

`core.cases.list_tasks`

List all tasks for a case. Enterprise Edition

Inputs

string

required

The ID of the case to list tasks for.

Examples

List tasks

- ref: list_tasks
  action: core.cases.list_tasks
  args:
    case_id: ${{ TRIGGER.case_id }}

`core.cases.update_task`

Update an existing case task. Enterprise Edition

Inputs

string

required

The ID of the task to update.

string | null

The ID of the user to assign the task to.Default: null.

object | null

The default trigger values for the task.Default: null.

string | null

The updated description of the task.Default: null.

string | null

The updated priority of the task (unknown, low, medium, high, critical).Default: null.

string | null

The updated status of the task (todo, in_progress, blocked, completed).Default: null.

string | null

The updated title of the task.Default: null.

string | null

The ID of the workflow associated with this task.Default: null.

Examples

Update a task

- ref: update_task
  action: core.cases.update_task
  args:
    task_id: ${{ TRIGGER.task_id }}
    status: in_progress

`core.cases.delete_task`

Delete a case task. Enterprise Edition

Inputs

string

required

The ID of the task to delete.

Examples

Delete a task

- ref: delete_task
  action: core.cases.delete_task
  args:
    task_id: ${{ TRIGGER.task_id }}

`core.cases.link_row`

Link an existing table row to a case. Enterprise Edition

Inputs

string

required

Case ID

string

required

Row ID

string

required

Table ID

Examples

Link a table row

- ref: link_row
  action: core.cases.link_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

`core.cases.unlink_row`

Remove a linked table row from a case. Enterprise Edition

Inputs

string

required

Case ID

string

required

Row ID

string

required

Table ID

Examples

Unlink a table row

- ref: unlink_row
  action: core.cases.unlink_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row_id: ${{ TRIGGER.row_id }}

`core.cases.insert_row`

Insert a row into a table and link it to a case. Enterprise Edition

Linked rows use regular tables. Create the destination table with the same columns schema documented in Tables.

Inputs

string

required

Case ID

object

required

Row values

string

required

Table ID

Examples

Insert and link a table row

- ref: insert_case_row
  action: core.cases.insert_row
  args:
    case_id: ${{ TRIGGER.case_id }}
    table_id: indicators
    row:
      value: ${{ TRIGGER.indicator }}
      indicator_type: domain

`core.cases.get_case_metrics`

Get case metrics as OTEL-aligned time-series for the provided case IDs. Enterprise Edition

Inputs

array[string]

required

List of case IDs to get case metrics for.

Examples

Read case metrics

- ref: case_metrics
  action: core.cases.get_case_metrics
  args:
    case_ids:
      - ${{ TRIGGER.case_id }}
      - ${{ TRIGGER.related_case_id }}

​core.cases.create_case

​Inputs

​Examples

​core.cases.get_case

​Inputs

​Examples

​core.cases.update_case

​Inputs

​Examples

​core.cases.list_cases

​Inputs

​Examples

​core.cases.search_cases

​Inputs

​Examples

​core.cases.list_case_events

​Inputs

​Examples

​core.cases.assign_user

​Inputs

​Examples

​core.cases.assign_user_by_email

​Inputs

​Examples

​core.cases.add_case_tag

​Inputs

​Examples

​core.cases.remove_case_tag

​Inputs

​Examples

​core.cases.delete_case

​Inputs

​Examples

​core.cases.create_comment

​Inputs

​Examples

​core.cases.reply_to_comment

​Inputs

​Examples

​core.cases.update_comment

​Inputs

​Examples

​core.cases.list_comments

​Inputs

​Examples

​core.cases.list_comment_threads

​Inputs

​Examples

​core.cases.get_comment_thread

​Inputs

​Examples

​core.cases.upload_attachment

​Inputs

​Examples

​core.cases.upload_attachment_from_url

​Inputs

​Examples

​core.cases.list_attachments

​Inputs

​Examples

​core.cases.get_attachment

​Inputs

​Examples

​core.cases.get_attachment_download_url

​Inputs

​Examples

​core.cases.download_attachment

​Inputs

​Examples

​core.cases.delete_attachment

​Inputs

​Examples

​core.cases.create_task

​Inputs

​Examples

​core.cases.get_task

​Inputs

​Examples

​core.cases.list_tasks

​Inputs

`core.cases.create_case`

Inputs

Examples

`core.cases.get_case`

Inputs

Examples

`core.cases.update_case`

Inputs

Examples

`core.cases.list_cases`

Inputs

Examples

`core.cases.search_cases`

Inputs

Examples

`core.cases.list_case_events`

Inputs

Examples

`core.cases.assign_user`

Inputs

Examples

`core.cases.assign_user_by_email`

Inputs

Examples

`core.cases.add_case_tag`

Inputs

Examples

`core.cases.remove_case_tag`

Inputs

Examples

`core.cases.delete_case`

Inputs

Examples

`core.cases.create_comment`

Inputs

Examples

`core.cases.reply_to_comment`

Inputs

Examples

`core.cases.update_comment`

Inputs

Examples

`core.cases.list_comments`

Inputs

Examples

`core.cases.list_comment_threads`

Inputs

Examples

`core.cases.get_comment_thread`

Inputs

Examples

`core.cases.upload_attachment`

Inputs

Examples

`core.cases.upload_attachment_from_url`

Inputs

Examples

`core.cases.list_attachments`

Inputs

Examples

`core.cases.get_attachment`

Inputs

Examples

`core.cases.get_attachment_download_url`

Inputs

Examples

`core.cases.download_attachment`

Inputs

Examples

`core.cases.delete_attachment`

Inputs

Examples

`core.cases.create_task`

Inputs

Examples

`core.cases.get_task`

Inputs

Examples

`core.cases.list_tasks`

Inputs