Torq cases streamline your incident management by allowing you to automate case creation, updates, and investigations through to resolution.
Creating a Case
To create a case and configure essential attributes like title, SLA, and severity, use one of the following steps:
Create a Case
Create a Case from JSON
Create a Case from Template
More information about automatic case creation is available here.
Updating a Case
Automate case updates using the various Torq Cases steps:
Modify Case Attributes: Automatically update properties like title, description, state, category, and more.
Manage Observables: Add, associate, or disassociate observables with cases. Update observable descriptions or reputation scores.
Document the Investigation: Automatically manage comments, attachments, links, and more.
Resolving or Closing a Case
The Resolved status shows that the issue has been addressed with possible follow-up tasks, whereas Closed means all actions are complete.
Update State: Use the Change case state step. To execute successfully when closing or resolving the case, add the Resolution reason optional parameter and provide a value.
Custom Transitions: Replace the default modal, asking the analyst to provide a reason for resolving or closing the case by customizing case state transitions.
Querying Cases: Use the Query cases step and the Resolution reasons optional parameter to filter and retrieve cases based on specific resolution reasons, enabling detailed reports and insights into case outcomes.
Manage the resolution reasons available in the workspace by navigating to Settings > Cases (read more).
