Overview
Use the Query cases step to retrieve cases based on specific criteria, enhancing your ability to automatically manage and analyze case data effectively. Customize your query with the step optional parameters to filter your search precisely.
How to use
The Query cases step can be used for:
Deduplication: Prevent duplicate case creation by checking for existing cases that meet your criteria.
Bulk Operations: Apply actions to multiple cases simultaneously, such as reassigning cases from one team member to another.
Threat Hunting: Identify all cases linked to a particular observable ID for targeted investigation.
Reporting and Analysis: Extract cases for detailed analysis, like identifying those nearing SLA breaches based on specific thresholds.
Optimize your search results with the Order and Order by parameters to sort the data based on specific property values, either in ascending or descending order.
Full list of optional parameters for the Query cases step:
Full list of optional parameters for the Query cases step:
Access mode - The access mode to filter by.
Access token - Torq cross tenant access token.
Assignees - Cases assignees to filter by, separated by commas.
Categories - Case categories to filter by, separated by commas.
Completed at from - Filter by completion time - beginning, in RFC3339 format.
Completed at to - Filter by completion time - end, in RFC3339 format.
Created from - Filter by creation time - beginning, in RFC3339 format. Defaults to 90 days ago.
Created to - Filter by creation time - end, in RFC3339 format. Defaults to current time.
Custom fields - Custom field "key:value" pairs to query by, separated by commas. Use the "*" character as the value to retrieve all cases that have the custom field. Use an empty value to retrieve all cases that has the key with no value set. To include a literal comma in a value, escape it with a backslash (e.g., value,with,commas).
Custom fields operator - The operator to use when querying by custom fields
Group IDs - Group IDs to filter cases by, separated by commas. Use an empty string to match cases with no group assigned.
Observable IDs - Observable IDs to filter related cases by, separated by commas.
Order - Descending or ascending order.
Order by - The field to order by.
Page size - The amount of cases to return in each page.
Page token - The page token to use for pagination.
Resolution reasons - Resolution reasons to query by, separated by commas.
Reviewers - Reviewers to filter by, separated by commas.
Runbooks - Runbook titles to query by, separated by commas.
Search - Free text to search in case title or description or pretty ID.
Severities - Cases severities to filter by, separated by commas.
SLA from - SLA start range to filter - a fraction between 0 and 1.
SLA to - SLA end range filter - a fraction between 0 and 1.
States - Cases states to filter by.
Tags - Case tags to query by, separated by commas.
Updated at from - Filter by update time - beginning, in RFC3339 format.
Updated at to - Filter by update time - end, in RFC3339 format.
Use case: Monitoring SLA utilization
Use Query cases to retrieve a list of cases with 80% or more of their SLA consumed. Based on the case's particularities, this allows proactive reminders to be sent to the responsible assignees or triggering escalation protocols, such as alerting on-call engineers.
