Attaching events to a case is crucial for providing a comprehensive view to anyone reviewing it. This ensures all relevant information is considered during the investigation.
Learn how to review events during a case investigation.
One example is event deduplication. Once a case is created after an event is processed, duplicate events shouldn't create new cases. You can keep a record of the duplicate events by attaching them to the existing case.
Attaching and Detaching Events
Attach an Event to a Case: Use the Attach event to case step. You will need to:
Specify the
case IDwhere the event should be attached.If attaching an event other than the one triggering the workflow, use the
Torq event IDoptional parameter to specify which event to attach.Optionally, add an
Event nameto provide a descriptive label for easier navigation within the attached events list.
Detach an Event from a Case: Use the Detach event from case step. This works similarly to attaching events but removes the event from the case instead.
