Skip to main content

Automating Case Timelines in Torq: Track Investigation Progress

Learn how to streamline investigations with case timeline automation using automated comments, user mentions, and public comment sharing.

Overview

Discover how to leverage Torq's case timeline automation features to streamline investigation processes. This guide focuses on automating timeline comments to enhance case management and improve team collaboration.

The case timeline displays comments and events chronologically, offering a detailed overview of all case-related actions. Learn the basics of how to use it here.

How to use

Automate timeline comments

Add comments automatically

Use the Add comment to case step within your workflows to insert comments directly into the case timeline. Enhance readability and organization by applying markdown syntax for formatting, including bold text, italics, and lists.

Incorporate tables

Add a structured table to your comment using the Create ASCII table step. Enable markdown support by setting the Markdown optional parameter to true, ensuring your table is cleanly formatted within the comment.

List timeline entries

Use the List case timeline events step to extract all the case timeline entries for further action or analysis. Use the step's optional parameters to narrow the query and retrieve the specific entries you need to address or review.

Engage users with mentions

Mention users automatically

Automatically mention users in any timeline comment to alert or draw their attention. Include the syntax <m:user@company.com> in your comment when using the Add comment to case step, or dynamically get the user email from the workflow context: <m:{{ $.event.user_email }}>.

Workflow triggers for mentions

Leverage the User mentioned workflow trigger to initiate specific workflows when a user is mentioned, enhancing responsiveness and team interaction within the investigation process.

Manage public comments

Public comments require activation for your workspace.

  1. Enable public comments: Contact Torq support to enable this feature, allowing broader communication with stakeholders.

  2. Mark comments as public: Analysts can designate a comment as public directly in the timeline.

  3. Use the Add comment to case step with the Visibility optional parameter set to public.

Share comments externally

Automatically share public comments outside of Torq by setting up workflows that trigger on the addition of a public comment. This can be particularly useful for updating stakeholders or integrating with external communication platforms.
One way to do this is to use the Comment added workflow trigger with a trigger condition to check that the comment visibility is public. Information can be extracted from the case or comment to convert it to an external update.

Did this answer your question?