Skip to content

Cases GraphQL API types

Every named type reachable from a query or mutation in this schema, grouped by kind.

Jump to: Objects · Enums · Input objects · Scalars

Objects

AddEvidenceToCaseResult

AddDetectionsToCaseInput describes the fields needed to add detections to an existing case.

Fields

Field Type Description
caseId ID! id of the case to add the evidence to
detectionIds [String!] Detections is a list of detection IDs that should be attached to the case
detectionsSearchQuery String detectionsSearchQuery is a QUERY query that should be used to add detections to the case
eventIds [String!] Events is a list of event IDs that should be attached to the case
searchQueries [String!] SearchQueries are saved searches that should be attached to the case. Searches added here are not executed to attach evidence, this field is only used to attached saved searches to the case.
hostIds [String!] HostIds is a list of host IDs that were submitted to have their assets attached to the case

Case

Case Describes a Taegis XDR case.

Fields

Field Type Description
id ID! ID of the case (unique)
shortId String! shortId is a identifier for the case that is human readable Short ids are not guaranteed to be created in order though they typically will be.
title String! Title of the case
keyFindings KeyFindingsDocument KeyFindings are used to explain the details of the case as a typed document envelope. NOTE: This field will not be returned in the Cases query. To get this field, you must query for the case by id using the case query.
severity Int! Severity of the case. 2 - Informational 4 - Low 6 - Medium 8 - High 10 - Critical
type CaseType! Type of the case
primaryStatus CasePrimaryStatus! primary status is the current primary status of the case
secondaryStatus CaseSecondaryStatus secondary status is the current secondary status of the case
secondaryStatusReason [String!]! secondaryStatusReason is a list of reasons associated with the current secondary status of the case
tags [String!] Tags used to help label the case
contributorIds [String!]! ContributorIds is a list of user ids that have contributed to the case
contributorSubjects [Subject]! ContributorSubjects is a federated list of subjects that have contributed to the case. This can be used to get the user information for the contributors. It is not guaranteed that all contributors will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
assigneeId String assigneeId is the id of the user, client or group assigned to the case It may be null to indicate that there is no assignee.
assigneeSubject Subject assigneeSubject is a federated field that can be used to get the user/client information for thee assignee. It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It will always be nil if the assignee id is set to be an @partner mention or @customer. It is not guaranteed that the assignee will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
tenantId String! TenantId is the id of the tenant that the case belongs to
tenant TenantV4 Tenant is a federated field that can be used to get the tenant information for the case. It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the tenant will be able to be resolved through federation. For example, if the federated service is down or the tenant was moved to another environment.
createdById String! CreatedById is the id of the user that created the case
createdBySubject Subject CreatedBySubject is a federated field that can be used to get the user information for the creator of the case. It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the createdBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
createdAt Time! CreatedAt is the time the case was created This field will be updated if the case was originally created in a draft state and then promoted.
updatedById String! UpdatedById is the id of the user that last updated the case
updatedBySubject Subject UpdatedBySubject is a federated field that can be used to get the user information for the last user that updated the case. It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the updatedBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
updatedAt Time! UpdatedAt is the time the case was last updated
archivedAt Time ArchivedAt is the time the case was archived This field will only be set if the case is archived. It will be set back to nil if the case was unarchived.
closedAt Time closedAt is the time the case was closed This field will only be set if the case has been closed. It will be set back to nil if the case is reopened.
closedById String closedById is the user identifier of the user who closed the case. This field will only be set if the case has been closed. It will be cleared if the case is reopened. On reopen-then-reclose, it reflects the most recent closer.
closedBySubject Subject closedBySubject is a federated field that can be used to get the user information for the closer. This field will only be set if the case has been closed. It is not guaranteed that the closedById will be able to be resolved through federation. For example, if the federated service is down or the subject was deleted.
closeReason String The reason provided by the user when closing a case. This field is only populated for cases that have reached a 'Closed' status.
riskScore Float riskScore is the calculated risk score of the case
primaryVerdict CasePrimaryVerdict primary verdict is the current primary verdict of the case Can only be set when the case is in a closed state.
secondaryVerdict CaseSecondaryVerdict secondary verdict is the current secondary verdict of the case Can only be set when the case is in a closed state. Not every primary verdict has a secondary verdict.
processingStatus CaseProcessingStatus! processingStatus contains the current status of each evidence type that could be processed for the case
ruleId ID ruleId is the id of the rule that opened the case - should be only set if the case was opened by a rule
source CaseSource source indicates the method used to generate the case. This field is nullable - cases are not required to have a source.
links [CaseLink!]! links are a list of 3rd party or other links that are related to the case.
managedBy CaseManagedBy managedBy indicates who manages the case - either the provider or the customer. There are times where this value may be unknown - for example if the case was created before this field was introduced. There may also be times where the case doesn't have a managed by yet. IE: It has not been claimed.
incidentAdvisorId ID incidentAdvisorId is the ID of the Incident Advisor assigned to the case.
incidentAdvisor IncidentAdvisor incidentAdvisor resolves the incident advisor's user details locally via the users API. Unlike assigneeSubject, this field is not federated through the subjects subgraph. Returns null if the incident advisor is not set or the user lookup fails.
queue CaseQueue queue is the routing queue the case is currently assigned to. Both fields within the queue are independently optional.
isCreatedByPartner Boolean! isCreatedByPartner is a field that denotes if the case was created by the child tenants parent tenant or not.
isCreatedByMDRProvider Boolean! isCreatedByMDRProvider denotes if the case was created by the tenant's MDR provider.
isCreatedByParent Boolean! isCreatedByParent denotes if the case was created by a parent tenant in the org hierarchy.
detectionsCount Int! detectionsCount is the count of detections attached to the case. Requesting this field can slow down the query if there are a large number of cases being requested. Do not request this field in a list query unless you need it.
eventsCount Int! eventsCount is the count of events attached to the case. Requesting this field can slow down the query if there are a large number of cases being requested. Do not request this field in a list query unless you need it.
assetsCount Int! assetsCount is the count of assets attached to the case. Requesting this field can slow down the query if there are a large number of cases being requested. Do not request this field in a list query unless you need it.

CaseAssetEvidence

CaseAssetEvidence describes the fields for asset evidence in a case.

Fields

Field Type Description
id ID! ID of the evidence entry (unique)
caseId ID! ID of the case the evidence is related to
tenantId String! Tenant id of the case/evidence
createdAt Time! Timestamp of when the evidence was added to the case
createdBy String Id of the user or client that added the evidence. If the evidence was added by the sync process where it was derived from other evidence that was added, this field will be set to the service account that added the evidence.
assetId String! Asset id

CaseComment

Comment describes the fields for a comment in a case.

Fields

Field Type Description
id ID! ID of the comment (unique)
authorId String! ID of the user that created the comment
authorSubject Subject authorSubject is a federated field that can be used to get the user information for the author of the comment It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the author will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
createdAt Time! createdAt is the time the comment was created
updatedAt Time! updatedAt is the time the comment was last updated
comment String! comment is the text of the comment
caseId ID! caseId is the id of the case the comment is associated with
tenantId String! tenantId is the tenant id of the case the comment is related to
mentionsIds [String!]! mentionsIds is a list of user ids and group mentions that are mentioned in the comment
mentionsSubjects [Subject]! mentionsSubjects is a list of subjects that are mentioned in the comment It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the mentions will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
readByIds [String!]! readByIds is a list of user ids that have marked the comment as read
readBySubjects [Subject]! readBySubjects is a list of subjects that have marked the comment as read It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the readBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
isInternal Boolean! isInternal denotes if the comment is internal and only visible to partner users

CaseComments

Comments defines the paginated results of a comments search.

Fields

Field Type Description
comments [CaseComment!]! List of the comments that match the search criteria for the current page
totalCount Int! The total number of comments that match the search criteria
totalUnreadCount Int! The total number of unread comments for the case (not affected by pagination or filters)

CaseDetectionEvidence

CaseDetectionEvidence describes the fields for detection evidence in a case.

Fields

Field Type Description
id ID! ID of the evidence entry (unique)
caseId ID! ID of the case the evidence is related to
tenantId String! Tenant id of the case/evidence
createdAt Time! Timestamp of when the evidence was added to the case
createdBy String Id of the user or client that added the evidence. If the evidence was added by the sync process where it was derived from other evidence that was added, this field will be set to the service account that added the evidence.
detectionId String! Detection id
isGenesis Boolean! IsGenesis is a flag that denotes if the evidence was used to initially open the case

CaseEventEvidence

CaseEventEvidence describes the fields for event evidence in a case.

Fields

Field Type Description
id ID! ID of the evidence entry (unique)
caseId ID! ID of the case the evidence is related to
tenantId String! Tenant id of the case/evidence
createdAt Time! Timestamp of when the evidence was added to the case
createdBy String! Id of the user or client that added the evidence. If the evidence was added by the sync process where it was derived from other evidence that was added, this field will be set to the service account that added the evidence.
eventId String! Event id
isGenesis Boolean! IsGenesis is a flag that denotes if the evidence was used to initially open the case

CaseEvidence

Fields

Field Type Description
id ID! ID of the case (unique)
detectionsEvidence [CaseDetectionEvidence!] DetectionsEvidence is a list of detection evidence attached to the case
detectionsEvidenceCount Int! DetectionsEvidenceCount is the count of detections attached to the case
assetsEvidence [CaseAssetEvidence!] AssetsEvidence is a list of asset evidence attached to the case
assetsEvidenceCount Int! AssetsEvidenceCount is the count of assets attached to the case
eventsEvidence [CaseEventEvidence!] EventsEvidence is a list of event evidence attached to the case
eventsEvidenceCount Int! EventsEvidenceCount is the count of events attached to the case
searchQueriesEvidence [CaseSearchQueryEvidence!] SearchQueriesEvidence is a list of search query evidence attached to the case
searchQueriesEvidenceCount Int! SearchQueriesEvidenceCount is the count of search queries attached to the case

CaseFile

CaseFile defines the fields for a file in a case.

Fields

Field Type Description
id ID! ID of the file (unique)
caseId ID! ID of the case the file is related to
tenantId String! Tenant id of the case/file
createdAt Time! Timestamp of when the file was added to the case
updatedAt Time! Timestamp of when the file was last updated
deletedAt Time Timestamp of when the file was deleted
uploadedById String! uploadedById is the id of the user that initialized the file upload
uploadedBySubject Subject uploadedBySubject is a federated field that can be used to get the user information for the user that initialized the file upload It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the uploadedBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
deletedById String! deletedById is the id of the user that deleted the file
deletedBySubject Subject deletedBySubject is a federated field that can be used to get the user information for the user that deleted the file It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the deletedBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
name String! Name of the file
path String location of the file
size Int! size of the file
status String! current upload status of the file
isEmbedded Boolean! Indicates if the file is embedded in case content (e.g., images in key findings). Embedded files do not generate audit logs when download URLs are requested.
metadata CaseFileMeta! additional metadata about the file
downloadURL String Signed download url of the file. The signature is only valid for 15 minutes. After that time, a new signed url must be requested to download the file.

CaseFileMeta

CaseFileMeta defines additional metadata for a file in a case.

Fields

Field Type Description
contentType String content type of the file
contentMD5 String md5 hash of the file

CaseFileUpload

CaseFileUpload is the response to initializing a file upload for a case.

Fields

Field Type Description
file CaseFile! file contains metadata about the file we expect to be uploaded to the presignedUrl
presignedUrl String! presignedUrl is the url to upload the file to

CaseFiles

Fields

Field Type Description
files [CaseFile!]!
totalCount Int!

Case links represent 3rd party or other links that are related to the case.

Fields

Field Type Description
id ID! ID of the link
caseId ID! caseId is the id of the case the link belongs to
reference String ID of the resource being linked to
url String! URL of the resource being linked to
title String Optional title of the resource being linked to If this is set, it will be used as the title of the link in the UI rather than the reference.
type String Optional type of the resource being linked to. IE: ServiceNow, 4Me, etc..
createdAt Time! Timestamp of when the link was added to the case
createdById String! createdById is the id of the user that created the link
updatedAt Time! updatedAt is the time the link was last updated
updatedById String! updatedById is the id of the user that last updated the link
isInternal Boolean! isInternal indicates if the link should be visible to internal users only

CasePrimaryStatus

CasePrimaryStatus defines a primary status that can group secondary statuses.

Fields

Field Type Description
id ID! Id of the case primary status
name String! Name of the case primary status (unique per tenant)
title String Title of the case primary status
description String Description of the case primary status
tenantId String! Tenant Id represents the owner of the primary status
createdById String! Id of the user that created the primary status
createdAt Time! Timestamp of when the primary status was created
updatedById String! Id of the user that last updated the primary status
updatedAt Time! Timestamp of when the primary status was last updated
isCaseVisibleToCustomers Boolean! Indicates if cases in this primary status are visible to customers
isClosed Boolean! Indicates if this primary status represents a closed state
supportedSecondaryStatuses [CaseSecondaryStatus!]! secondaryStatuses is the expanded secondary status objects (optional federation)

CasePrimaryStatuses

Fields

Field Type Description
primaryStatuses [CasePrimaryStatus!]!

CasePrimaryVerdict

CasePrimaryVerdict defines a primary verdict that can group secondary verdicts.

Fields

Field Type Description
id ID! Id of the case primary verdict
name String! Name of the case primary verdict (unique per tenant)
title String Title of the case primary verdict
description String Description of the case primary verdict
tenantId String! Tenant Id represents the owner of the primary verdict
createdById String! Id of the user that created the primary verdict
createdAt Time! Timestamp of when the primary verdict was created
updatedById String! Id of the user that last updated the primary verdict
updatedAt Time! Timestamp of when the primary verdict was last updated
supportedSecondaryVerdicts [CaseSecondaryVerdict!]! secondaryStatuses is the expanded secondary Verdict objects (optional federation)

CasePrimaryVerdicts

Fields

Field Type Description
primaryVerdicts [CasePrimaryVerdict!]!

CaseProcessingStatus

CaseProcessingStatus defines the possible evidence that can have processing states as well as the current state of the processing.

Fields

Field Type Description
assets CaseProcessingState
events CaseProcessingState
detections CaseProcessingState

CaseQueue

CaseQueue is an opaque reference to a routing queue that the case is assigned to. The Cases service does not validate or resolve these values; they originate in external systems (e.g., MDR Genesys queue routing). The name is captured at write time and may drift from the originating system's current name for the queue.

Fields

Field Type Description
referenceId String referenceId is an opaque identifier for the queue, provided by the originating system.
name String name is the display name of the queue at the time it was last written.

CaseRule

CaseRule contains the configuration for an auto-case rule.

Fields

Field Type Description
id ID! ID of the rule (unique)
createdById String! ID of the user that created the rule
createdBySubject Subject createdBySubject is a federated field that can be used to get the user information for the creator of the case rule It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the createdBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
createdAt Time! createdAt is the time the case rule was created
updatedById String! ID of the user that last updated the case rule
updatedBySubject Subject updatedBySubject is a federated field that can be used to get the user information for the last user that updated the case rule It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the updatedBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
updatedAt Time! updatedAt is the time the case rule was last updated
tenantId String! ID of the tenant that the case rule belongs to
name String! Name of the rule
title String Title of the rule - when displaying the rule visually, if this field is set, it should be used to represent the rule and not the name
description String Description of the rule
tags [String!] Tags used to help label the rule
type CaseRuleType! Type denotes the type of the rule and determines what is used to evaluate detections
order Int! Order defines the order in which rules should be evaluated. The lower the number, the sooner the rule will be evaluated. Once a rule's filter has matched and been applied to an detection, the system stops trying to apply other rules.
detectionSeverities [DetectionSeverity!] Detection severities this rule triggers on. An empty list means the rule is not restricted by severity.
state CaseRuleState! State defines processing behavior for the rule
filter String! Detection filter expressed as a QL expression
appendFilter String Optional filter that can define different detection constraints (i.e. broader) for appending vs creating
appendComment String Optional comment that is expanded and a comment generated when an detection is appended to an existing non-draft case
groupBy [String!]! Optional group by clause that adds additional matching detections to an existing case
groupCount Int Count is an optional specification of the number of required matches of the group by clause
groupDuration String Duration specifies an optional period (as a string in format [d|h|m|s]) to continue grouping detections after a matching case is closed
groupExtendOnAppend Boolean Optional flag indicating if newly appended detections should expand the set of entities/attributes used to group detections, defaults to false
searchQueries [String!]! Optional search queries used to populate additional detections or events into a newly created case
searchWindow String Optional search window specifies duration from the genesis detections over which the search is evaluated
tenantFilter String Setting to filter tenants based on attributes such as enabled services and/or same tenant as rule definition
skipDetectionPrioritization Boolean! Setting to skip checking if the priority of the detection has been downgraded when evaluating detections
isGlobal Boolean! isGlobal indicates if this rule applies to all tenants. Can only be set for rules under tenant 5000. This flag does not apply to Legacy Taegis tenants at this time but it will as they are migrated into Central. This includes MSSPs and their customers. As they are migrated, rules with this flag will also apply to them.
template CaseTemplate! Template defining case content

CaseRules

CaseRules defines the paginated results of a case rule search.

Fields

Field Type Description
rules [CaseRule!]!
totalCount Int!

CaseSearchQueryEvidence

CaseSearchQueryEvidence describes the fields for search query evidence in a case.

Fields

Field Type Description
id ID! ID of the evidence entry (unique)
caseId ID! ID of the case the evidence is related to
tenantId String! Tenant id of the case/evidence
createdAt Time! Timestamp of when the evidence was added to the case
createdBy String Id of the user or client that added the evidence. If the evidence was added by the sync process where it was derived from other evidence that was added, this field will be set to the service account that added the evidence.
searchQueryId String! Search query
isGenesis Boolean! IsGenesis is a flag that denotes if the evidence was used to initially open the case

CaseSecondaryStatus

CaseSecondaryStatus defines a case status

Fields

Field Type Description
id ID! Id of the case secondary status
name String! Name of the case secondary status
title String Title of the case secondary status
description String Description of the case type
tenantId String! Tenant Id represents the owner of the case type
createdById String! createdById denotes the user that created the type
createdAt Time! Timestamp of when the case type was created
updatedById String! createdById denotes the user that created the type
updatedAt Time! Timestamp of when the case type was last updated
allowedSubstatusReasons [String!]! allowedSubstatusReasons defines the valid substatus reasons that can be set on a case with this secondary status
automationOnly Boolean! automationOnly marks a status that is set by automation and hidden from human status pickers by default

CaseSecondaryStatuses

Fields

Field Type Description
secondaryStatuses [CaseSecondaryStatus!]!

CaseSecondaryVerdict

CaseSecondaryVerdict defines a case secondary Verdict

Fields

Field Type Description
id ID! Id of the case secondary verdict
name String! Name of the case secondary verdict
title String Title of the case secondary verdict
description String Description of the case type
tenantId String! Tenant Id represents the owner of the case verdict
createdById String! createdById denotes the user that created the verdict
createdAt Time! Timestamp of when the case verdict was created
updatedById String! createdById denotes the user that created the verdict
updatedAt Time! Timestamp of when the case verdict was last updated

CaseSecondaryVerdicts

Fields

Field Type Description
secondaryVerdicts [CaseSecondaryVerdict!]!

CaseSource

CaseSource defines a source channel for a case

Fields

Field Type Description
id ID! Id of the case source
name String! Name of the case source
title String Title of the case source
description String Description of the case source
tenantId String! Tenant Id represents the owner of the case source
allowedNextSources [CaseSource!]! Allowed next sources this source can transition to

CaseSources

Fields

Field Type Description
sources [CaseSource!]!

CaseTemplate

CaseTemplate contains a set of pre-defined set of attributes used to populate a case. A template can be either be used to open a new case or applied to an existing case.

Fields

Field Type Description
id ID! ID of the case template (unique)
createdById String! ID of the user that created the case template
createdBySubject Subject createdBySubject is a federated field that can be used to get the user information for the creator of the case template It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the createdBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
createdAt Time! createdAt is the time the case template was created
updatedById String! ID of the user that last updated the case template
updatedBySubject Subject updatedBySubject is a federated field that can be used to get the user information for the last user that updated the case template It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the updatedBy will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
updatedAt Time! updatedAt is the time the case template was last updated
tenantId String! ID of the tenant that the case template belongs to
name String! Name of the template
title String Title of the template - when displaying the template visually, if this field is set, it should be used to represent the template and not the name
description String Description of the template
tags [String!] Tags used to help label the template
caseTypeId ID! Type of the case should be opened as
caseSeverity Int! Severity of the case
caseTitle String! Title of the case
caseTags [String!] Tags used to help label the case
caseKeyFindings KeyFindingsTemplate keyFindings is a typed document envelope with a CEL template that can be used to populate and explain the details of the case
caseKeyFindingsPrompts [String!] keyFindingsPrompts are a set of cel templates that can be used to populate and explain the details of the case based on responses from OpenAI
caseAssignee String! External Assignee is used to set the user assigned to the case
caseAssigneeSubject Subject caseAssigneeSubject is a federated field that can be used to get the user information for the assignee of the case template It is a convenience field that will be nil if the api does not think the field can be rendered through federation. It is not guaranteed that the assignee will be able to be resolved through federation. For example, if the federated service is down or the subject was delete.
casePrimaryStatusId ID! Initial status of the case
caseSecondaryStatusId ID Initial secondary status of the case
caseSecondaryStatusReason [String!] caseSecondaryStatusReason is a list of reasons associated with the secondary status
casePrimaryVerdictId ID casePrimaryVerdictId is used to describe the state of the case when closed This can only be set when the case template is being created with a closed state.
caseSecondaryVerdictId ID caseSecondaryVerdictId is used to describe the state of the case This can only be set when the case template is being created with a closed state and the primary verdict supports the provided verdict.
CaseManagedBy CaseManagedBy CaseManagedBy indicates who manages the case - either the provider or the customer. This field is optional. If the case type associated with the template has a managedBy setting, that will take precedence over this field. If not provided and no case type configuration exists, the case will be considered unclaimed.
queue CaseQueue queue is the routing queue assignment captured on the template. When the template is applied, the queue values will be propagated to the case. Both subfields are independently optional.
usages [TemplateUsage!] Possible usages of the template
isSharedWithChildTenants Boolean! Whether this template should be shared with child tenants. If true, child tenants will be able to use this template.
generateKeyFindings Boolean! Whether key findings should be automatically generated for cases created from this template

CaseTemplates

CaseTemplates defines the paginated results of a case template search.

Fields

Field Type Description
templates [CaseTemplate!]! List of the templates that match the search criteria for the current page
totalCount Int! The total number of templates that match the search criteria

CaseType

CaseType defines a case type

Fields

Field Type Description
id ID! Id of the type
name String! Name of the type
title String Title of the case type
description String Description of the case type
tenantId String! Tenant Id represents the owner of the case type
createdById String! createdById denotes the user that created the type
createdAt Time! Timestamp of when the case type was created
updatedById String! createdById denotes the user that created the type
updatedAt Time! Timestamp of when the case type was last updated
supportedPrimaryStatusIds [ID!]! Ids of the primary statuses that are valid for this type
supportedPrimaryStatuses [CasePrimaryStatus!]! primary statuses that are valid for this type
supportedSecondaryStatusIds [ID!]! Ids of the secondary statuses that are valid for this type
supportedSecondaryStatuses [CaseSecondaryStatus!]! secondaryStatuses that are valid for this type
supportedPrimaryVerdictIds [ID!]! Ids of the primary verdicts that are valid for this type
supportedPrimaryVerdicts [CasePrimaryVerdict!]! primary verdicts that are valid for this type
allowedNextTypes [CaseType!]! allowedNextTypes are the case types that this type can transition to.
managedBy CaseManagedBy managedBy indicates who manages the case - either the provider or the customer. This field is optional. If it is set, any new cases created with this type will have the managedBy field set to the same value.

CaseTypes

Fields

Field Type Description
types [CaseType!]!

Cases

Cases defines the paginated results of a case search.

Fields

Field Type Description
cases [Case!]! List of the cases that match the search criteria for the current page
totalCount Int! The total number of cases matching the search criteria.
pageInfo PageInfo! Cursor/page metadata. Populated in both offset and cursor modes.

IncidentAdvisor

IncidentAdvisor represents the resolved user details for a case's incident advisor. Resolved locally via the Taegis users API, not via subjects federation.

Fields

Field Type Description
id ID!
email String
givenName String
familyName String

KeyFindingsDocument

KeyFindingsDocument is a typed document envelope for key findings.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
content String! The content of the key findings. This is always a string. If the content is structured (e.g. a rich-text editor's JSON document), it must be serialized to a string first (e.g. JSON.stringify()).

KeyFindingsTemplate

KeyFindingsTemplate is a typed document envelope for key findings templates.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
contentTemplate String! The CEL template expression for the content

MergeCaseResult

MergeCaseResult is returned once the source cases are transitioned and the evidence association is queued.

Fields

Field Type Description
targetCaseId ID! targetCaseId is the case that received the merged evidence.
sourceCaseIds [ID!]! sourceCaseIds are the cases that were merged into the target.
processingEventId ID! processingEventId correlates the queued async evidence association.

PageInfo

PageInfo carries cursor/page metadata for paginated case results.

Fields

Field Type Description
startCursor String Cursor of the first row on this page. Null if the page is empty.
endCursor String Cursor of the last row on this page. Null if the page is empty.
hasNextPage Boolean! True if there is at least one more row after this page.
hasPreviousPage Boolean! True if there is at least one row before this page.

RemoveEvidenceFromCaseResult

RemoveEvidenceFromCaseResult describes the fields needed to remove evidence from an existing case.

Fields

Field Type Description
caseId ID! id of the case to remove the evidence from
detectionIds [String!] Detections is a list of detection IDs that should be removed from the case
eventIds [String!] Events is a list of event IDs that should be removed from the case
assetIds [String!] Assets is a list of asset IDs that should be removed from the case
searchQueries [String!] searchQueries is a list of search queries that should be removed from the case

SplitCaseResult

SplitCaseResult is returned once the destination case exists and the move is queued.

Fields

Field Type Description
caseId ID! caseId is the source case.
destinationCaseId ID! destinationCaseId is the new case created synchronously by this mutation.
detectionIds [ID!]!
eventIds [ID!]!
searchQueries [String!]!
fileIds [ID!]!

Subject

Fields

Field Type Description
id ID!

TenantV4

Fields

Field Type Description
id ID!

Enums

CaseCommentVisibilityFilter

CommentVisibilityFilter defines the possible filters for comments.

Values

Value Description
INTERNAL Only return internal comments
NOT_INTERNAL Only return non-internal comments
ALL Return all comments (default)

CaseManagedBy

Values

Value Description
PROVIDER
CUSTOMER

CaseProcessingState

CaseProcessingState defines the possible states for processing a case evidence.

Values

Value Description
SUCCESS
FAILED
RUNNING

CaseRuleState

Values

Value Description
ENABLED Enabled turns the rule on. The rule will evaluate against detections and it will both create new cases off the detections and append detections to existing cases
APPEND Append turns the rule on. The rule will evaluate against detections but it will only append detections to existing cases it will not create new cases
DISABLED Disabled turns the rule off and it will not be evaluated against detections
TEST Test turns the rule on and affects evaluation but it will not actually create or append detections. Logs will still be created to help validate your rule will work as expected.

CaseRuleType

CaseRuleType defines the possible types for a case. The types are used to determine how detections are evaluated.

Values

Value Description
STATIC Static rules are used to evaluate detections against a static set of defined criteria. The rule matching and grouping will be defined using TQL and QUERY expressions.
DETECTION_THREAD Detection Thread rules are used to define rules that should rely on the detection threading system to determine detection matching and grouping into cases.

DetectionSeverity

Severity a case rule can trigger on. LOW and INFO are not supported yet; MEDIUM is the floor for this phase.

Values

Value Description
MEDIUM
HIGH
CRITICAL

DocumentType

DocumentType describes the format of the key findings content.

Values

Value Description
MARKDOWN
RICH_TEXT

PaginationOrder

PaginationOrder defines the enums that can be used to order the results in ascending or descending order

Values

Value Description
ASCENDING Orders the resulting page in ascending order
DESCENDING Orders the resulting page in descending order

TemplateUsage

TemplateUsage denotes how the template is used. A Template can have one or more usages

Values

Value Description
MANUAL
AUTO_INVESTIGATION

Input objects

AddCaseComment

AddCaseComment describes the fields needed to add a comment to a case.

Fields

Field Type Description
caseId String! ID of the case to add the comment to
comment String! comment is the text of the comment to add to the case. It can contain @mentions to notify users of the comment.
isInternal Boolean isInternal marks the comment as internal and only visible to partner users Only partner users can create internal comments. Default: false.

AddEvidenceToCaseInput

AddDetectionsToCaseInput describes the fields needed to add evidence to an existing case.

Fields

Field Type Description
caseId ID! case id to add the evidence to
detectionIds [String!] Detections is a list of detection IDs that should be attached to the case
detectionsSearchQuery String DetectionsSearchQuery is a QUERY query that should be used to add detections to the case
eventIds [String!] Events is a list of event IDs that should be attached to the case
searchQueries [String!] SearchQueries are saved searches that should be attached to the case. Search queries added during the creation of a case are considered genesis evidence. Searches added here are not executed to attach evidence, this field is only used to attached saved searches to the case.
hostIds [String!] HostIds is a list of host IDs whose assets should be attached to the case. Assets added through this mutation will not be considered genesis evidence.

CaseArguments

CaseArguments describes the parameters to search for a case.

Fields

Field Type Description
id ID!

CaseCommentsArguments

CaseCommentsArguments describes the parameters to search for comments in a case.

Fields

Field Type Description
caseId String! ID of the case to get the comments for
orderBy PaginationOrder orderBy is the order to sort the comments by their createdAt timestamp
visibility CaseCommentVisibilityFilter visibility is used to filter the comments by their visibility (isInternal) Default: ALL.
page Int page of results to return - pages start on 1 Default: 1.
perPage Int number of results per page - max 100 Default: 25.

CaseEvidenceArguments

Fields

Field Type Description
id ID! ID of the case to get evidence for

CaseFileArguments

CaseFileArguments describes the parameters to get a file attached to a case.

Fields

Field Type Description
fileId ID!

CaseFilesArguments

Fields

Field Type Description
query String query string to search for files
page Int page of results to return - pages start on 1 Default: 1.
perPage Int number of results per page - max 100 Default: 20.

CasePrimaryStatusesArguments

Fields

Field Type Description
typeId ID typeId can be used to filter results to only include statuses that are valid for the type.
transitionFromId ID transitionFromId can be used to provide a case primary status id to filter the results to only include the types that the provided type can transition to
caseId ID caseId can be used to filter results based on caller permissions for a specific case. When the case is provider-managed and the caller is not a partner or MDR provider, only closed statuses are returned.

CasePrimaryVerdictsArguments

Fields

Field Type Description
typeId ID typeId can be used to filter results to only include verdicts that are valid for the given case type.
primaryStatusId ID primaryStatusId can be used to filter results to only include verdicts that are valid for the given primary status.
caseId ID caseId can be used to filter results based on the entitlements the case was created with. When the case has a recorded entitlement snapshot, results are restricted to that snapshot rather than the tenant's current licenses.
includeAutomationVerdicts Boolean includeAutomationVerdicts, when true, includes automation-only verdicts (e.g. Automation-Dismissal, Default) that are applied by automation and not normally shown to human users. Defaults to false. Default: false.

CaseRuleArguments

CaseRuleArguments describes the parameters to find a case rule. Both id and name are unique identifiers for a rule. At least one of the fields must be set, if both are set, both must match a rule.

Fields

Field Type Description
id ID
name String

CaseRulesArguments

CaseRulesArguments describes the parameters for a search of case rules.

Fields

Field Type Description
query String query string to search for templates
page Int page of results to return - pages start on 1 Default: 1.
perPage Int number of results per page - max 100 Default: 20.

CaseSecondaryStatusesArguments

Fields

Field Type Description
typeId ID typeId can be used to filter results to only include statuses that are valid for the type.
primaryStatusId ID primaryStatus can be used to filter results to only include sub-statuses that are grouped by the given primary status.
caseId ID caseId can be used to filter results based on the entitlements the case was created with. When the case has a recorded entitlement snapshot, results are restricted to that snapshot rather than the tenant's current licenses.
includeAutomationStatuses Boolean includeAutomationStatuses, when true, includes automation-only statuses in the results. Defaults to false so system-applied statuses are not shown to humans. Default: false.

CaseSecondaryVerdictsArguments

Fields

Field Type Description
primaryVerdictId ID primaryVerdictId can be used to filter results to only include secondary verdicts that are valid for the given primary verdict.
caseId ID caseId can be used to filter results based on the entitlements the case was created with. When the case has a recorded entitlement snapshot, results are restricted to that snapshot rather than the tenant's current licenses.

CaseSourcesArguments

Fields

Field Type Description
transitionFromId ID transitionFromId can be used to provide a case source id to filter the results to only include the sources that the provided source can transition to

CaseTemplateArguments

CaseTemplateArguments describes the parameters to find a case template. Both id and name are unique identifiers for a template. At least one of the fields must be set, if both are set, both must match a template.

Fields

Field Type Description
id ID
name String

CaseTemplatesArguments

CaseTemplatesArguments describes the parameters for a search of case templates.

Fields

Field Type Description
query String query string to search for templates
page Int page of results to return - pages start on 1 Default: 1.
perPage Int number of results per page - max 100 Default: 20.

CaseTypesArguments

Fields

Field Type Description
transitionFromId ID transitionFromId can be used to provide a case type id to filter the results to only include the types that the provided type can transition to
caseId ID caseId filters results to the types the referenced case may transition to. In addition to the entitlement scoping (the case's recorded entitlement snapshot, when present, otherwise the tenant's current licenses), results are restricted to the case's current type's allowed next types and to types whose managedBy is compatible with the case's managedBy (types with an unset managedBy are always included; a case with an unset managedBy applies no managedBy restriction). An explicit transitionFromId takes precedence over the case's own type as the transition source.

CasesArguments

CasesArguments describes the parameters for a search of cases.

Fields

Field Type Description
query String query string to search for cases
tenantServiceFilters [String!] tenant service labels to search for
pagination CasesPagination Pagination. Exactly one of offset or cursor MUST be set when provided. If omitted, defaults to offset { page: 1, perPage: 20 }.

CasesPagination

CasesPagination selects between offset and cursor pagination. Setting both or neither produces a BAD_REQUEST error at the resolver.

Fields

Field Type Description
offset OffsetPagination
cursor CursorPagination

CreateCaseInput

CreateCaseInput Describes the fields available for creating a new case.

Fields

Field Type Description
typeId ID! ID of the Type the case should be opened as Types are restricted to the available types for the current user and tenant service level.
severity Int! Severity of the case. 2 - Informational 4 - Low 6 - Medium 8 - High 10 - Critical
title String! Title of the case. Max 256 characters anything over that will be trimmed.
tags [String!] Tags used to help label the case
keyFindings CreateKeyFindingsDocumentInput KeyFindings are used to explain the details of the case as a typed document envelope
primaryStatusId ID! primaryStatusId is used to describe the state of the case Statuses are restricted to the available statuses for the current user and tenant.
secondaryStatusId ID secondaryStatusId is used to describe the state of the case Statuses are restricted to the available statuses for the current user and tenant.
secondaryStatusReason [String!] secondaryStatusReason is a list of reasons associated with the secondary status. Each reason must be valid for the selected secondary status (see allowedSubstatusReasons on CaseSecondaryStatus). Not required even if the secondary status defines allowed reasons.
primaryVerdictId ID primaryVerdictId is used to describe the state of the case when closed This can only be set when the case is being created in a closed state.
secondaryVerdictId ID secondaryVerdictId is used to describe the state of the case This can only be set when the case is being created in a closed state and the primary verdict supports the provided verdict.
assigneeId String assigneeId is used to set the user assigned to the case. The assignee must be a valid user, client, or @mention in the system. Optional. If null or empty, the case is created with no assignee.
detectionIds [String!] Detections is a list of detection IDs that should be attached to the case. Detections added during the creation of a case are considered genesis evidence.
detectionsSearchQuery String DetectionsSearchQuery is a QUERY query that can be used to attach detections to the case. Only the first 50k detections will be attached to the case. Detections added via a search query during the case create will be considered genesis evidence.
eventIds [String!] Events is a list of event IDs that should be attached to the case. Events added during the creation of a case are considered genesis evidence.
searchQueries [String!] SearchQueries are saved searches that should be used to open the case. Search queries added during the creation of a case are considered genesis evidence. Searches added here are not executed to attach evidence, this field is only used to attached saved searches to the case.
hostIds [String!] HostIds is a list of host IDs whose assets should be attached to the case on creation. Assets added during the creation of a case are considered genesis evidence.
managedBy CaseManagedBy managedBy indicates who manages the case - either the provider or the customer. This field is optional. If not provided, the case will be considered unclaimed unless the selected case type defines a managed by value. Once this field is set, it cannot be changed. In situations where the case type defines a managedBy, providing a value here that does not match the allowed value will return an error. In those situations, providing a null value here is allowed.
incidentAdvisorId ID incidentAdvisorId is used to assign an Incident Advisor to cases managed by a provider.
sourceId ID sourceId is the ID of the case source. Optional.
queue CreateCaseQueueInput queue is the routing queue the case is being created in. Only partner / MDR provider users may set this field. Both subfields are independently optional.

Input for creating a new case link.

Fields

Field Type Description
caseId ID! caseId is the id of the case to add the link to
reference String ID of the resource being linked to either external or internal to Taegis
url String! URL of the resource being linked to
title String Optional title of the resource being linked to If this is set, it will be used as the title of the link in the UI rather than the reference.
type String Optional type of the resource being linked to. IE: ServiceNow, 4Me, etc..
isInternal Boolean isInternal indicates if the link should be visible to internal users only - defaults to false Default: false.

CreateCaseQueueInput

CreateCaseQueueInput sets the routing queue when a case (or case template) is being created. Both fields are independently optional; only partner / MDR provider users may set queue values.

Fields

Field Type Description
referenceId String referenceId is the opaque queue identifier from the originating system.
name String name is the display name to capture for the queue at write time.

CreateCaseRuleInput

CreateCaseRuleInput Describes the fields used for creating a new case rule.

Fields

Field Type Description
name String! Name of the rule to create. May only consist of letters, numbers and underscores. Once the name is set, it cannot be changed.
title String Title of the rule - can be changed later.
description String Description of the rule
tags [String!] Tags used to help label the rule
type CaseRuleType! Type denotes the type of the rule and determines how detections are evaluated
order Int! Order defines the order in which rules should be evaluated. Duplicate order values are not allowed. Adding a rule with a duplicate order will insert the rule at the desired position and bump all rules greater than or equal to the inserted rule order up one.
detectionSeverities [DetectionSeverity!] Detection severities this rule triggers on. Leave empty or unset for no severity restriction.
state CaseRuleState! State defines processing behavior for the rule
filter String! filter is a ql/cel expression that is used to match detections to the rule
appendFilter String appendFilter is an optional filter that can define different detection constraints (i.e. broader) for appending vs creating
appendComment String appendComment is an optional comment that is expanded and a comment generated when an detection is appended to an existing non-draft case
groupBy [String!] groupBy by clause that adds additional matching detections to an existing open case
groupCount Int groupCount is an optional specification of the number of required matches of the group by clause
groupDuration String groupDuration specifies an optional period (as a string in format [h|m|s]) to continue grouping detections after a matching case is closed
groupExtendOnAppend Boolean groupExtendOnAppend is an optional flag indicating if newly appended detections should extend the set of entities/attributes used to group detections, defaults to false
searchQueries [String!] searchQueries is an optional list of query expressions used to populate additional detections or events into a newly created case
searchWindow String searchWindow is an optional duration from the genesis detections over which the searchQueries are evaluated
tenantFilter String tenantFilter can be used to filter tenants based on attributes such as enabled services and/or same tenant as rule definition
skipDetectionPrioritization Boolean! skipDetectionPrioritization can be used to skip checking if the priority of the detection has been downgraded when evaluating detections
isGlobal Boolean isGlobal indicates if this rule applies to all tenants (only valid for tenant 5000) Default: false.
templateId ID! templateId is the id of the template the rule should use when it needs to open a new case
responseData JSONObject ResponseData provides rule-specific context/configuration for playbooks.

CreateCaseTemplateInput

CreateCaseTemplateInput Describes the fields used for creating a new case template.

Fields

Field Type Description
name String! Name of the template to create. May only consist of letters, numbers and underscores. Once the name is set, it cannot be changed.
title String Title of the rule - can be changed later.
description String Description of the template
tags [String!] Tags used to help label the template
caseTypeId ID! The Type id that should be used to set the initial type of case
caseSeverity Int! Severity of the case
caseTitle String! Title of the case
caseTags [String!] Tags used to help label the case
caseKeyFindings CreateKeyFindingsTemplateInput caseKeyFindings is a typed document envelope with a CEL template that can be used to populate and explain the details of the case
caseKeyFindingsPrompts [String!] caseKeyFindingsPrompts are a set of CEL templates that can be used to populate and explain the details of the case based on responses from OpenAI
caseAssignee String! Assignee is used to set the user assigned to the case
casePrimaryStatusId ID! Primary Status Id that the case should be opened with.
caseSecondaryStatusId ID Secondary Status Id that the case should be opened with.
caseSecondaryStatusReason [String!] caseSecondaryStatusReason is a list of reasons associated with the secondary status. Each reason must be valid for the selected secondary status.
casePrimaryVerdictId ID casePrimaryVerdictId is used to describe the state of the case when closed This can only be set when the case template is being created with a closed state.
caseSecondaryVerdictId ID caseSecondaryVerdictId is used to describe the state of the case This can only be set when the case template is being created with a closed state and the primary verdict supports the provided verdict.
caseManagedBy CaseManagedBy caseManagedBy indicates who manages the case - either the provider or the customer. This field is optional. If not provided, the case will be created as unclaimed unless the case type defines a managed by value. If the case type associated with the template has a managedBy setting, and this field is provided with a value that does not match, an error will be returned.
queue CreateCaseQueueInput queue captures the routing queue to record on the template. Only partner / MDR provider users may set this field. Both subfields are independently optional.
usages [TemplateUsage!] Possible usages Default: ["AUTO_INVESTIGATION"].
isSharedWithChildTenants Boolean Whether this template should be shared with child tenants. If true, child tenants will be able to use this template. Defaults to false. Default: false.
generateKeyFindings Boolean Whether key findings should be automatically generated for cases created from this template. Defaults to false. Default: false.

CreateKeyFindingsDocumentInput

CreateKeyFindingsDocumentInput describes the fields for creating key findings on a case.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
content String! The content of the key findings. This is always a string. If the content is structured (e.g. a rich-text editor's JSON document), it must be serialized to a string first (e.g. JSON.stringify()).

CreateKeyFindingsTemplateInput

CreateKeyFindingsTemplateInput describes the fields for creating key findings on a case template.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
contentTemplate String! The CEL template expression for the content

CursorPagination

CursorPagination uses opaque cursors for stable traversal. Valid combinations: { first } | { first, after } | { last } | { last, before }. Any other combination returns BAD_REQUEST.

Fields

Field Type Description
first Int forward page size — max 100, default 20
after String cursor marking where to resume forward traversal
last Int backward page size — max 100, default 20
before String cursor marking where to resume backward traversal

DeleteCaseCommentInput

DeleteCaseCommentInput describes the fields needed to delete a comment from a case.

Fields

Field Type Description
commentId String!

DeleteCaseFileInput

DeleteCaseFileInput describes the fields needed to delete a file from a case.

Fields

Field Type Description
fileId ID!

Input for deleting an existing case link.

Fields

Field Type Description
id ID! ID of the link to delete

DeleteCaseRuleInput

DeleteCaseRuleInput Describes the fields available for deleting an existing case rule.

Fields

Field Type Description
id ID! ID of the rule to update

DeleteCaseTemplateInput

DeleteCaseTemplateInput defines the fields available for deleting an existing case template.

Fields

Field Type Description
id ID! ID of the template to delete

MergeCaseInput

MergeCaseInput selects a target case and the source cases whose in-scope evidence is associated with it.

Fields

Field Type Description
targetCaseId ID! targetCaseId is the case that receives the merged evidence and is retained.
sourceCaseIds [ID!]! sourceCaseIds are the cases whose in-scope evidence is associated with the target; they are then dismissed/closed.
archiveSources Boolean archiveSources, when true, also archives the merged source cases.

OffsetPagination

OffsetPagination uses 1-indexed page numbers with a fixed page size.

Fields

Field Type Description
page Int 1-indexed page number Default: 1.
perPage Int results per page — max 100 Default: 20.

RemoveEvidenceFromCaseInput

RemoveEvidenceFromCaseResult describes the fields needed to remove evidence from an existing case.

Fields

Field Type Description
caseId ID! case id
detectionIds [String!] Detections is a list of detection IDs that should be removed from the case
eventIds [String!] Events is a list of event IDs that should be removed from the case
assetIds [String!] Assets is a list of asset IDs that should be removed from the case
searchQueries [String!] searchQueries is a list of search queries that should be removed from the case

SplitCaseInput

SplitCaseInput describes the destination case and selected evidence to move from the source case.

Fields

Field Type Description
caseId ID!
newCase CreateCaseInput!
detectionIds [ID!]
eventIds [ID!]
searchQueries [String!]
fileIds [ID!]

StartCaseFileUploadInput

StartCaseFileUploadInput describes the fields needed to initialize a file upload for a case.

Fields

Field Type Description
caseId ID! ID of the case to upload the file to
name String! Name of the file
size Int! Expected size of the file
contentType String! expected content type of the file
isEmbedded Boolean indicates if the file is meant to be embedded (e.g., in key findings) Default: false.

UpdateCaseCommentInput

UpdateCaseCommentInput describes the fields needed to update a comment in a case.

Fields

Field Type Description
commentId String! ID of the comment to update
comment String comment is the text of the comment to update
markAsRead Boolean mark as read will mark the comment as read for the current user

UpdateCaseInput

UpdateCaseInput describes the fields available for updating a case. Optional fields that are not provided will not be updated.

Fields

Field Type Description
id ID! Id of the case to update
typeId ID Id of the Type the case should be updated to. Types are restricted to the available types for the current user and tenant service level.
severity Int Severity of the case. 2 - Informational 4 - Low 6 - Medium 8 - High 10 - Critical
title String Title to update the case with
tags [String!] Tags used to help label the case Tags are not additive, the tags provided will replace the existing tags on the case. If you want to keep the existing tags, you must include them in the tags field. Not sending the tags field at all (null) will not update the tags.
keyFindings UpdateKeyFindingsDocumentInput KeyFindings are used to explain the details of the case as a typed document envelope. Null clears, omitted means no change.
primaryStatusId ID primaryStatusId is used to describe the state of the case Statuses are restricted to the available statuses for the current user and tenant.
secondaryStatusId ID secondaryStatusId is used to describe the state of the case Statuses are restricted to the available statuses for the current user and tenant.
secondaryStatusReason [String!] secondaryStatusReason is a list of reasons associated with the secondary status. Each reason must be valid for the selected secondary status (see allowedSubstatusReasons on CaseSecondaryStatus). If the primary or secondary status changes, this field will be automatically cleared.
primaryVerdictId ID primaryVerdictId is used to describe the state of the case when closed This can only be set when the case is being created in a closed state.
secondaryVerdictId ID secondaryVerdictId is used to describe the state of the case This can only be set when the case is being created in a closed state and the primary verdict supports the provided verdict.
assigneeId String assigneeId is used to update the user assigned to the case. The assignee must be a valid user, client, or @mention in the system. Optional. Null or omitted means no change. An empty string clears the current assignee. A non-empty value sets the assignee. Updating the assignee id and setting the status to AWAITING_ACTION will trigger a handoff if the assignee id changes, an email will be sent to the new assignee.
managedBy CaseManagedBy managedBy indicates who manages the case - either the provider or the customer. This field is optional. If not provided, the case will be considered unclaimed. Once this field is set, it cannot be changed. If the case is already managed, then providing this field will return an error.
incidentAdvisorId ID incidentAdvisorId is used to assign an Incident Advisor to cases managed by a provider. Can be cleared by sending an empty string.
closeReason String closeReason is an optional field that can be used to provide a reason for closing the case. This field only has meaning when the case is being moved to a closed status and is set in the same call but it can be set at any time with any status.
isArchived Boolean isArchived controls the archive status of the case. - Set to true to archive the case (only allowed for closed cases) - Set to false to unarchive the case - Null or omitted: no change to archive status
sourceId ID sourceId is the ID of the case source. If current source has empty allowedNextSources, source cannot be changed. Once source is set, it cannot be cleared to null.
queue UpdateCaseQueueInput queue is the routing queue assignment to apply to the case. Only partner / MDR provider users may set this field. Immutable once the case is closed. Omitted = no change. Subfields are independently optional within the input.

Input for updating an existing case link.

Fields

Field Type Description
id ID! ID of the link to update
reference String ID of the resource being linked to either external or internal to Taegis
url String Optional URL of the resource being linked to
title String Optional title of the resource being linked to If this is set, it will be used as the title of the link in the UI rather than the reference.
type String Optional type of the resource being linked to. IE: ServiceNow, 4Me, etc..
isInternal Boolean isInternal indicates if the link should be visible to internal users only - defaults to false

UpdateCaseQueueInput

UpdateCaseQueueInput sets the routing queue when a case (or case template) is being updated. Both fields are independently optional. Only partner / MDR provider users may set queue values. Immutable once the case is closed.

Fields

Field Type Description
referenceId String referenceId is the opaque queue identifier from the originating system.
name String name is the display name to capture for the queue at write time.

UpdateCaseRuleInput

UpdateCaseRuleInput Describes the fields available for updating an existing case rule.

Fields

Field Type Description
id ID! ID of the rule to update
title String Title of the rule (changing this only affects the visual representation of the rule).
description String Description of the rule
tags [String!] Tags used to help label the rule. Tags are not additive, the tags provided will replace the existing tags on the case. If you want to keep the existing tags, you must include them in the tags field. Not sending the tags field at all (null) will not update the tags.
order Int Order defines the order in which rules should be evaluated. Duplicate order values are not allowed. Adding a rule with a duplicate order will insert the rule at the desired position and bump all rules greater than or equal to the inserted rule order up one.
detectionSeverities [DetectionSeverity!] Detection severities this rule triggers on. Severities are not additive, the list provided will replace the existing list. Sending an empty list clears the restriction (the rule becomes unrestricted by severity). Not sending this field at all (null) will not update the existing severities.
state CaseRuleState State defines processing behavior for the rule
filter String filter is a ql/cel expression that is used to match detections to the rule
appendFilter String appendFilter is an optional filter that can define different detection constraints (i.e. broader) for appending vs creating
appendComment String appendComment is an optional comment that is expanded and a comment generated when an detection is appended to an existing non-draft case
groupBy [String!] groupBy by clause that adds additional matching detections to an existing open case
groupCount Int groupCount is an optional specification of the number of required matches of the group by clause
groupDuration String groupDuration specifies an optional period (as a string in format [h|m|s]) to continue grouping detections after a matching case is closed
groupExtendOnAppend Boolean groupExtendOnAppend is an optional flag indicating if newly appended detections should extend the set of entities/attributes used to group detections, defaults to false
searchQueries [String!] searchQueries is an optional list of query expressions used to populate additional detections or events into a newly created case
searchWindow String searchWindow is an optional duration from the genesis detections over which the searchQueries are evaluated
tenantFilter String tenantFilter can be used to filter tenants based on attributes such as enabled services and/or same tenant as rule definition
skipDetectionPrioritization Boolean skipDetectionPrioritization can be used to skip checking if the priority of the detection has been downgraded when evaluating detections
isGlobal Boolean isGlobal indicates if this rule applies to all tenants (only valid for tenant 5000)
templateId ID templateId is the id of the template the rule should use when it needs to open a new case
responseData JSONObject ResponseData provides rule-specific context/configuration for playbooks.

UpdateCaseTemplateInput

UpdateCaseTemplateInput Describes the fields used for updating an existing case template.

Fields

Field Type Description
id ID! ID of the template to update
title String Title to update the template with
description String Description to update the template with
tags [String!] Tags that used to help label the template . Tags are not additive, the tags provided will replace the existing tags on the case. If you want to keep the existing tags, you must include them in the tags field. Not sending the tags field at all (null) will not update the tags.
caseTypeId ID The Type id that should be used to set the initial type of case
caseSeverity Int Severity of the case
caseTitle String Title of the case
caseTags [String!] Tags used to help label the case
caseKeyFindings UpdateKeyFindingsTemplateInput caseKeyFindings is a typed document envelope with a CEL template. Null clears, omitted means no change.
caseKeyFindingsPrompts [String!] caseKeyFindingsPrompts are a set of CEL templates that can be used to populate and explain the details of the case based on responses from OpenAI
caseAssignee String External Assignee is used to set the user assigned to the case
casePrimaryStatusId ID Primary Status Id that the case should be opened with.
caseSecondaryStatusId ID Secondary Status Id that the case should be opened with.
caseSecondaryStatusReason [String!] caseSecondaryStatusReason is a list of reasons associated with the secondary status. Each reason must be valid for the selected secondary status.
casePrimaryVerdictId ID casePrimaryVerdictId is used to describe the state of the case when closed This can only be set when the case template is being created with a closed state.
caseSecondaryVerdictId ID caseSecondaryVerdictId is used to describe the state of the case This can only be set when the case template is being created with a closed state and the primary verdict supports the provided verdict.
caseManagedBy CaseManagedBy caseManagedBy indicates who manages the case - either the provider or the customer. This field is optional. If not provided, the case will be created as unclaimed unless the case type defines a managed by value.
queue UpdateCaseQueueInput queue updates the routing queue stored on the template. Only partner / MDR provider users may set this field. Omitted = no change. Subfields are independently optional.
generateKeyFindings Boolean Whether key findings should be automatically generated for cases created from this template

UpdateKeyFindingsDocumentInput

UpdateKeyFindingsDocumentInput describes the fields for updating key findings on a case.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
content String! The content of the key findings. This is always a string. If the content is structured (e.g. a rich-text editor's JSON document), it must be serialized to a string first (e.g. JSON.stringify()).

UpdateKeyFindingsTemplateInput

UpdateKeyFindingsTemplateInput describes the fields for updating key findings on a case template.

Fields

Field Type Description
documentType DocumentType! The format of the content
documentVersion String! The version of the document format
contentTemplate String! The CEL template expression for the content

Scalars

JSONObject

JSON payload

Time

The default Time implementation for this library.