commonfields: id: SearchCases version: -1 name: SearchCases script: '-' isInternal: true type: python comment: Retrieves cases based on the provided filters. enabled: true args: - description: A comma separated list of case IDs. isArray: true name: case_id_list - description: "The start time for filtering according to case creation time. Supports free text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025." name: start_time - description: "The end time for filtering according to case creation time. Supports free text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025." name: end_time - auto: PREDEFINED description: Sorts returned cases by the date/time that the case was created ("asc" - ascending, "desc" - descending). name: sort_by_creation_time predefined: - asc - desc - description: 'Filters for cases with the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.' name: status - auto: PREDEFINED description: Whether the case is starred. name: starred predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether to include enriched case data in the response. Recommended for up to 10 cases. name: get_enriched_case_data defaultValue: 'false' predefined: - 'true' - 'false' - defaultValue: '0' description: Page number (for pagination). The default is 0 (the first page). name: page - defaultValue: '100' description: Maximum number of cases to return per page. The default and maximum is 100. name: page_size outputs: - contextPath: Core.Case.case_id description: Unique ID assigned to each returned case. type: String - contextPath: Core.Case.case_name description: Name of the case. type: String - contextPath: Core.Case.creation_time description: Timestamp when the case was created. type: Number - contextPath: Core.Case.modification_time description: Timestamp when the case was last modified. type: Number - contextPath: Core.Case.detection_time description: Timestamp when the first issue was detected in the case. May be null. type: Date - contextPath: Core.Case.status description: Current status of the case. type: String - contextPath: Core.Case.severity description: Severity level of the case. type: String - contextPath: Core.Case.description description: Description of the case. type: String - contextPath: Core.Case.assigned_user_mail description: Email address of the assigned user. May be null. type: String - contextPath: Core.Case.assigned_user_pretty_name description: Full name of the assigned user. May be null. type: String - contextPath: Core.Case.issue_count description: Total number of issues in the case. type: Number - contextPath: Core.Case.low_severity_issue_count description: Number of issues with low severity. type: Number - contextPath: Core.Case.med_severity_issue_count description: Number of issues with medium severity. type: Number - contextPath: Core.Case.high_severity_issue_count description: Number of issues with high severity. type: Number - contextPath: Core.Case.critical_severity_issue_count description: Number of issues with critical severity. type: Number - contextPath: Core.Case.user_count description: Number of users involved in the case. type: Number - contextPath: Core.Case.host_count description: Number of hosts involved in the case. type: Number - contextPath: Core.Case.notes description: Notes related to the case. May be null. type: String - contextPath: Core.Case.resolve_comment description: Comments added when resolving the case. May be null. type: String - contextPath: Core.Case.resolved_timestamp description: Timestamp when the case was resolved. type: Number - contextPath: Core.Case.manual_severity description: Severity manually assigned by the user. May be null. type: Number - contextPath: Core.Case.manual_description description: Description manually provided by the user. type: String - contextPath: Core.Case.xdr_url description: URL to view the case in Cortex XDR. type: String - contextPath: Core.Case.starred description: Indicates whether the case is starred. type: Boolean - contextPath: Core.Case.starred_manually description: True if the case was starred manually; false if starred by rules. type: Boolean - contextPath: Core.Case.hosts description: List of hosts involved in the case. type: Array - contextPath: Core.Case.users description: List of users involved in the case. type: Array - contextPath: Core.Case.case_sources description: Sources of the case. type: Array - contextPath: Core.Case.rule_based_score description: Score based on rules. type: Number - contextPath: Core.Case.manual_score description: Manually assigned score. May be null. type: Number - contextPath: Core.Case.wildfire_hits description: Number of WildFire hits. type: Number - contextPath: Core.Case.issues_grouping_status description: Status of issue grouping. type: String - contextPath: Core.Case.mitre_tactics_ids_and_names description: List of MITRE ATT&CK tactic IDs and names associated with the case. type: Array - contextPath: Core.Case.mitre_techniques_ids_and_names description: List of MITRE ATT&CK technique IDs and names associated with the case. type: Array - contextPath: Core.Case.issue_categories description: Categories of issues associated with the case. type: Array - contextPath: Core.Case.original_tags description: Original tags assigned to the case. type: Array - contextPath: Core.Case.tags description: Current tags assigned to the case. type: Array - contextPath: Core.Case.case_domain description: Domain associated with the case. type: String - contextPath: Core.Case.custom_fields description: Custom fields for the case with standardized lowercase, whitespace-free names. type: Unknown - contextPath: Core.Case.CaseExtraData.issue_ids description: List of issue IDs associated with the case. type: Array - contextPath: Core.Case.CaseExtraData.file_artifacts description: File artifacts associated with the case. type: Array - contextPath: Core.Case.CaseExtraData.network_artifacts description: Network artifacts associated with the case. type: Array subtype: python3 dockerimage: demisto/python3:3.12.12.5490952 fromversion: 6.6.0 tests: - No tests (auto formatted) marketplaces: - platform deprecated: true