Overview
Use the Query cases step to retrieve cases based on specific criteria, enabling you to automatically manage and analyze case data. Customize the query with the step optional parameters to filter your search precisely.
How to use
The Query cases step can be used for:
Deduplication: Prevent duplicate case creation by checking for existing cases that meet your criteria.
Bulk Operations: Apply actions to multiple cases simultaneously, such as reassigning cases from one team member to another.
Threat Hunting: Identify all cases linked to a particular observable ID for targeted investigation.
Reporting and Analysis: Extract cases for detailed analysis, like identifying those nearing SLA breaches based on specific thresholds.
Optimize your search results with the Order and Order by parameters to sort the data based on specific property values, either in ascending or descending order.
Full list of optional parameters for the Query cases step:
Full list of optional parameters for the Query cases step:
Access mode - The access mode to filter by.
Access token - Torq cross tenant access token.
Assignees - Cases assignees to filter by, separated by commas.
Categories - Case categories to filter by, separated by commas.
Completed at from - Filter by completion time - beginning, in RFC3339 format.
Completed at to - Filter by completion time - end, in RFC3339 format.
Created from - Filter by creation time - beginning, in RFC3339 format. Defaults to 90 days ago.
Created to - Filter by creation time - end, in RFC3339 format. Defaults to current time.
Custom fields - Custom field "key:value" pairs to query by, separated by commas. Use the "*" character as the value to retrieve all cases that have the custom field. Use an empty value to retrieve all cases that has the key with no value set. To include a literal comma in a value, escape it with a backslash (e.g., value,with,commas).
Custom fields operator - The operator to use when querying by custom fields
Group IDs - Group IDs to filter cases by, separated by commas. Use an empty string to match cases with no group assigned.
Observable IDs - Observable IDs to filter related cases by, separated by commas.
Order - Descending or ascending order.
Order by - The field to order by.
Page size - The amount of cases to return in each page.
Page token - The page token to use for pagination.
Resolution reasons - Resolution reasons to query by, separated by commas.
Reviewers - Reviewers to filter by, separated by commas.
Runbooks - Runbook titles to query by, separated by commas.
Search - Free text to search in case title or description or pretty ID.
Severities - Cases severities to filter by, separated by commas.
SLA from - SLA start range to filter - a fraction between 0 and 1.
SLA to - SLA end range filter - a fraction between 0 and 1.
States - Cases states to filter by.
Tags - Case tags to query by, separated by commas.
Updated at from - Filter by update time - beginning, in RFC3339 format.
Updated at to - Filter by update time - end, in RFC3339 format.
Query cases across workspaces
Use the Query cases across workspaces step to retrieve cases across multiple workspaces in your org. Create a new cross-workspace API key in Org Admin settings to scope a service account key to some or all workspaces, including future ones.
Customize the query using the optional step parameters:
The Workspace IDs parameter scopes results to specific workspaces. When used, a cross-tenant access token is also required, which can be generated using the Generate a cross-tenant access token step.
Add filter optional parameters to include case filters in your query, such as Assignee, State, Severity, and more.
Use the Output Fields parameter to control exactly which fields are returned, including custom fields, custom SLA, and case links.
Use case: Monitoring SLA utilization
Use Query cases to retrieve a list of cases with 80% or more of their SLA consumed. Based on the case's particularities, this allows proactive reminders to be sent to the responsible assignees or triggering escalation protocols, such as alerting on-call engineers.
