Console
    Start free

    REST Resource: projects.locations.instances.cases

    Resource: Case

    A Case represents a security investigation in SecOps. Cases group related alerts and provide a central location for analysts to document their findings, track progress, and collaborate on resolving security incidents.

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "creatorUserId" 
 : 
 string 
 , 
 "creatorUser" 
 : 
 string 
 , 
 "lastModifyingUserId" 
 : 
 string 
 , 
 "lastModifyingUser" 
 : 
 string 
 , 
 "createTime" 
 : 
 string 
 , 
 "updateTime" 
 : 
 string 
 , 
 "displayName" 
 : 
 string 
 , 
 "alertCount" 
 : 
 integer 
 , 
 "stage" 
 : 
 string 
 , 
 "priority" 
 : 
 enum (  Priority 
 
) 
 , 
 "assignee" 
 : 
 string 
 , 
 "assignedUser" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "type" 
 : 
 enum (  CaseType 
 
) 
 , 
 "environment" 
 : 
 string 
 , 
 "status" 
 : 
 enum (  CaseStatus 
 
) 
 , 
 "score" 
 : 
 number 
 , 
 "workflowStatus" 
 : 
 enum (  WorkflowStatus 
 
) 
 , 
 "sla" 
 : 
 { 
 object (  Sla 
 
) 
 } 
 , 
 "alertsSla" 
 : 
 { 
 object (  Sla 
 
) 
 } 
 , 
 "source" 
 : 
 string 
 , 
 "tags" 
 : 
 [ 
 { 
 object (  CaseTag 
 
) 
 } 
 ] 
 , 
 "products" 
 : 
 [ 
 { 
 object (  CaseProduct 
 
) 
 } 
 ] 
 , 
 "closureDetails" 
 : 
 { 
 object (  CaseClosureDetails 
 
) 
 } 
 , 
 "tasks" 
 : 
 [ 
 { 
 object (  Task 
 
) 
 } 
 ] 
 , 
 "moveEnvironment" 
 : 
 { 
 object (  MoveEnvironment 
 
) 
 } 
 , 
 "dataAccessScopes" 
 : 
 [ 
 string 
 ] 
 , 
 "important" 
 : 
 boolean 
 , 
 "incident" 
 : 
 boolean 
 , 
 "overflowCase" 
 : 
 boolean 
 , 
 "involvedSuspiciousEntity" 
 : 
 boolean 
 }
    Fields
    name

    string

    Identifier. The unique name(ID) of the Case. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}
    creatorUserId

    string

    Output only. Case creator id. Used for homepage/requests feature.
    creatorUser

    string

    Output only. Resource association for the creator.
    lastModifyingUserId

    string

    Output only. Last user who modified the case. replaced old property name: LastModifyingUser.
    lastModifyingUser

    string

    Output only. Resource association for the modifying user.
    createTime

    string ( int64 format)

    Output only. The creation time of the record in milliseconds.
    updateTime

    string ( int64 format)

    Output only. The modification time of the record in milliseconds.
    displayName

    string

    Required. Case title, limited to 200 characters. Replaces old property: Title.
    alertCount

    integer

    Output only. Alerts in case.
    stage

    string

    Required. The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".
    priority

    enum ( Priority )

    Required. Default value is HIGH. Case priority. For example, "Informative", "Low", "Medium", "High", "Critical".
    assignee

    string

    Optional. This can be a user or a @SocRole, default value is the default soc-role defined in Settings.
    assignedUser

    string

    Output only. Resource association for the assignee.
    description

    string

    Optional. Case description. Limit chars to 1000.
    type

    enum ( CaseType )

    Required. Case type.
    environment

    string

    Required. Case logical environments.
    status

    enum ( CaseStatus )

    Output only. Case data status.
    score

    number

    Optional. Attack exposure score, how risky the case.
    workflowStatus

    enum ( WorkflowStatus )

    Output only. Case playbook status.
    sla

    object ( Sla )

    Optional. SLA for the case.
    alertsSla

    object ( Sla )

    Optional. Aggregated alerts SLA. (alert has SLA as well).
    source

    string

    Output only. The source that created the case. Possible values: "Server", "User", "Simulated", "Merge", "AlertMove"
    tags[]

    object ( CaseTag )

    Optional. CaseTags associated with the case.
    products[]

    object ( CaseProduct )

    Optional. Products associated with the case. Contains Name of product (e.g. WinEventLog:Security/DLP_Product). Replaces old property: "Product".
    closureDetails

    object ( CaseClosureDetails )

    Optional. Case closure details.
    tasks[]

    object ( Task )

    Output only. Tasks associated with the case.
    moveEnvironment

    object ( MoveEnvironment )

    Optional. Case environment move details.
    dataAccessScopes[]

    string

    Output only. Data Access Scopes.
    important

    boolean

    Optional. Additional way to specify case importance. The default is false.
    incident

    boolean

    Optional. Additional way to specify if the case marked as incident. The default is false.
    overflowCase

    boolean

    Output only. Case without events, was reduced by the connector service due to a large amount of data. During ingestion if the "alert package" crosses a specific threshold, the alert will be trimmed due to security reasons (DDOS attacks, etc..)
    involvedSuspiciousEntity

    boolean

    Optional. If has involved suspicious entity in the case.

    CaseType

    Case type. LINT.IfChange(case_type)

    Enums
    CASE_TYPE_UNSPECIFIED Unspecified case type.
    EXTERNAL Case created based on alerts from external SIEM.
    TEST Case created based on simulated alerts for testing.
    REQUEST Case created internally through the Homepage feature.

    CaseStatus

    Case status.

    Enums
    CASE_DATA_STATE_UNSPECIFIED Unspecified case data status.
    OPENED Case data is opened.
    CLOSED Case data is closed.
    ALL Case data is all.
    MERGED Case data is merged.
    CREATION_PENDING Case data is creation pending.

    WorkflowStatus

    Workflow status.

    Enums
    WORKFLOW_STATUS_UNSPECIFIED Unspecified workflow status.
    NONE Workflow status is none.
    IN_PROGRESS Workflow is running.
    COMPLETED Workflow is completed.
    FAILED Workflow is failed.
    TERMINATED Workflow is terminated.
    PENDING_IN_QUEUE Workflow is pending in queue.
    PENDING_FOR_USER Workflow is pending for user.

    CaseTag

    CaseTag associated with the case.

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 , 
 "priority" 
 : 
 integer 
 }
    Fields
    displayName

    string

    Output only. The name of the tag
    alert

    string

    Output only. For tags set by playbook action, this is relevant during MoveAlert. Replaces old property: "Indicator".
    priority

    integer

    Output only. During ingestion if more than one tag matches the criteria, the one with the priority will be chosen. Available options: 1-5.

    CaseProduct

    Product associated with the case.

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 }
    Fields
    displayName

    string

    Output only. Display name of the product.
    alert

    string

    Output only. Replaces old property: "AlertIdentifier".

    CaseClosureDetails

    Case closure details.

    JSON representation 
     { 
 "reason" 
 : 
 enum (  CloseReason 
 
) 
 , 
 "rootCause" 
 : 
 string 
 , 
 "caseClosedAction" 
 : 
 enum (  CaseClosedAction 
 
) 
 , 
 "comment" 
 : 
 string 
 }
    Fields
    reason

    enum ( CloseReason )

    Output only. Case closure reason.
    rootCause

    string

    Output only. Case closure root cause.
    caseClosedAction

    enum ( CaseClosedAction )

    Output only. Case closed action.
    comment

    string

    Output only. Case closure comment.

    CloseReason

    Case closure reason. LINT.IfChange(closeReason)

    Enums
    CLOSE_REASON_UNSPECIFIED Unspecified close reason.
    MALICIOUS Case is malicious.
    NOT_MALICIOUS Case is not malicious.
    MAINTENANCE Case is in maintenance.
    INCONCLUSIVE Case is inconclusive.
    UNKNOWN Case closure reason is unknown.

    CaseClosedAction

    Case closed action. LINT.IfChange(caseClosedAction)

    Enums
    CASE_CLOSED_ACTION_UNSPECIFIED Unspecified case closed action.
    AUTOMATIC Case closed action is automatic.
    MANUALLY Case closed action is manually.

    MoveEnvironment

    Case environment move details.

    JSON representation 
     { 
 "shouldDeleteOldCase" 
 : 
 boolean 
 }
    Fields
    shouldDeleteOldCase

    boolean

    Optional. If the case should be deleted on move to the new environment.

    Methods

    addTag

    		Adds a tag to a Case.

    createInsight

    		Adds an insight to a Case.

    executeBulkAddTag

    		Adds a tag to multiple cases in a single operation.

    executeBulkAssign

    		Assigns multiple cases to a specific analyst or SOC role in bulk.

    executeBulkChangePriority

    		Changes the priority level for multiple cases in bulk.

    executeBulkChangeStage

    		Updates the case stage for multiple cases in bulk.

    executeBulkClose

    		Closes multiple cases in a single operation.

    executeBulkReopen

    		Reopens multiple previously closed cases in a single operation.

    generateReport

    		Generates a report for a Case in a specified format (e.g., PDF, HTML).

    get

    		Gets a single Case by its resource name.

    getCaseOverviewData

    		Retrieves the case view metadaata.

    list

    		Lists Cases in an instance.

    merge

    		Merges one or more cases into a single destination case.

    patch

    		Updates an existing Case.

    pauseSla

    		Pauses the Service Level Agreement (SLA) timer for a specific Case.

    removeTag

    		Removes a tag from a Case.

    resolveOverviewWidget

    		Resolves updated data for a specific case overview widget.

    resumeSla

    		Resumes a previously paused SLA timer for a Case.
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: