When automatically provisioning a new workspace, you can configure case management settings right from the start, ensuring the workspace is ready for immediate use. This approach not only saves time but also guarantees consistency across operations and adherence to protocols.
After creating a workspace and generating an access token, you can customize various case management options, such as states, presets, and resolution reasons.
The steps outlined in this article can also be used to configure an existing workspace. Alternatively, you can manage Cases settings directly from the Cases Settings page.
The configurations suggested below will overwrite any existing settings. For example, using the Set case management resolution reasons step will replace the default resolution reasons with those specified for the new workspace.
States
Automatically set case management states that match your work process and organizational needs.
Add the Set Case Management States step.
Define the states for the workspace (see step input example below). More information about custom states is available here.
Add the Access token optional parameter and specify the access token previously generated for the new workspace.
Set Case Management States Step Input Example
Set Case Management States Step Input Example
{ "new": { // The core structure, consisting of five default states - new, in progress, on hold, resolved, and closed, must be preserved. A default state cannot be deleted.
"name": "New", // The names of the default states can be modified. The name of a state must consist of at least two characters.
"sub_states": [ // Each default state can have up to five custom sub-states. The custom states will inherit the characteristics of the default state.
"substate_1", // The name of a state must consist of at least two characters.
"substate_2",
"substate_3",
"substate_4",
"substate_5"
]
},
"in_progress": {
"name": "In Progress",
"sub_states": [
"substate_1",
"substate_2",
"substate_3",
"substate_4",
"substate_5"
]
},
"on_hold": {
"name": "On Hold",
"sub_states": [
"substate_1",
"substate_2",
"substate_3",
"substate_4",
"substate_5"
]
},
"resolved": {
"name": "Resolved",
"sub_states": [
"substate_1",
"substate_2",
"substate_3",
"substate_4",
"substate_5"
]
},
"closed": {
"name": "Closed",
"sub_states": [
"substate_1",
"substate_2",
"substate_3",
"substate_4",
"substate_5"
]
}
}
Presets
Automatically set case management presets to ensure that the desired views of the Cases page are available. You can also set a default preset for the workspace.
Add the Set case management presets step.
Define the presets for the workspace. Give each preset a unique name and specify the filters and their values (see step input example below).
The Created at filter can accept 2 types of values. Use relative to specify a duration relative to the current time, or use from and to to define a specific time window.
Custom fields can also be specified as filters.
Add the Access token optional parameter and specify the access token previously generated for the new workspace.
Optionally, add the Default preset parameter to set a default view for the Cases page.
Set Case Management Presets Step Input Example
Set Case Management Presets Step Input Example
[
{
"name": "preset name", // Assign a meaningful name for the preset. While this example demonstrates a single preset, you can easily expand it to define multiple presets. The presets listed in this step input will replace any existing custom presets in the workspace without affecting the default presets.
"filters": { // Define which filters to include in the preset and set the values for each (select from the options available in the Cases page UI).
"severities": [
"High",
"Medium"
],
"assignees": [
"john@torq.io",
"jane@torq.io"
],
"created_at": { // Use the "relative" value to indicate a duration relative to the present moment, or opt for "from" and "to" (similar to the SLA filter value shown below) to establish a precise time range.
"relative": "Last 7 days"
},
"sla_range": {
"from": 0.8,
"to": 1
},
"categories": [
"AppSec",
"Malware"
],
"tags": [
"AI-Assisted",
"3rd-party"
],
"custom_fields": [ // Custom fields can serve as filters. Specify the custom field key and the desired value. It's important to note that, unlike other filters, you can only specify one possible value for the custom field key to filter cases.
{
"key": "Cloud Instance Id",
"value": "EC2-324243423"
}
],
"pending_tasks": true
}
}
]
Resolution Reasons
Automatically set the case management resolution reasons that analysts can specify when closing or resolving a case.
Add the Set case management resolution reasons step.
Specify the resolution reasons for the workspace.
Add the Access token optional parameter and specify the access token previously generated for the new workspace.
