Sign in
Case

Build a Case around a Reference Alert, or a Signal Alert

Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation.

post/create

Request body

contextCreateContext — unresolved $ref
organizationstring identity

Organization identity string in uhash:<hash> format (e.g., uhash:2vefBNqkbi). This is the organization ID, not a user identity.

status'New' | 'InProgress' | 'Dismissed' | 'Resolved'

The Status of the Case

priority'Informational' | 'Moderate' | 'High'

The Priority of the Case

titlestring
descriptionstring
assigneestring identity

Organization identity string in uhash:<hash> format (e.g., uhash:2vefBNqkbi). This is the organization ID, not a user identity.

Response

Success

datastring identity

The identity of a task

Example response

{
  "data": "task:96b12d30-b14c-461f-8377-fc36a01c91fe"
}

Changes