Skip to content

Search and Filter Cases๐Ÿ”—

Search for cases using the Cases query language, the same query syntax used in Secureworksยฎ Taegisโ„ข XDR Advanced Search.

Search Cases๐Ÿ”—

Query available cases by title, severity, status, dates, and more.

Query๐Ÿ”—

query searchCases($arguments: CasesArguments!) {
    cases(arguments: $arguments) {
        cases {
            id
            shortId
            title
            severity
            type {
                id
                name
            }
            primaryStatus {
                id
                name
            }
            tags
            assigneeId
            createdAt
            updatedAt
        }
        totalCount
        pageInfo {
            startCursor
            endCursor
            hasNextPage
            hasPreviousPage
        }
    }
}

Variables๐Ÿ”—

Search with a query:

{
    "arguments": {
        "query": "title contains 'suspicious login'",
        "pagination": {
            "offset": {
                "page": 1,
                "perPage": 20
            }
        }
    }
}

Query Syntax๐Ÿ”—

Basic Query Structure๐Ÿ”—

[where] <field> <operator> <value> [AND <field> <operator> <value> ...] [| sort <field> [asc|desc]]

The where keyword is optional.

Searchable Fields๐Ÿ”—

Field Type Description
id UUID Case ID
shortId String Human-readable ID (e.g., CSE00001)
title String Case title
severity Number Severity: 2, 4, 6, 8, 10
riskScore Number Risk score value
tags Array Case tags
assigneeId String Assigned user or team
createdAt Timestamp Creation time
updatedAt Timestamp Last update time
closedAt Timestamp Close time (null if open)
closeReason String Reason provided when the case was closed
archivedAt Timestamp Archive time (null if not archived)
managedBy String PROVIDER or CUSTOMER
typeId UUID Case type ID
primaryStatusId UUID Primary status ID

Operators๐Ÿ”—

Operator Example
= shortId = 'CSE00001'
!= severity != 2
contains title contains 'phishing'
!contains title !contains 'Draft'
in (...) primaryStatusId in ('uuid1', 'uuid2')
is null closedAt is null
is not null closedAt is not null

Logical Operators๐Ÿ”—

Combine conditions with AND:

title contains 'suspicious' AND severity >= 6 AND closedAt is null

String Values๐Ÿ”—

Enclose strings in single quotes:

title contains 'phishing attack'

Array Fields (tags)๐Ÿ”—

Match cases where tags contain specific values:

tags contains 'malware'
tags in ('malware', 'phishing', 'ransomware')

Sort๐Ÿ”—

Order results with the | sort operator:

title contains 'phishing' | sort severity desc
title contains 'phishing' | sort createdAt asc

Default sort is createdAt DESC (newest first).

Time Ranges๐Ÿ”—

Filter by date range using ISO 8601 timestamps:

createdAt >= '2024-08-01T00:00:00Z' AND createdAt <= '2024-08-31T23:59:59Z'

Query Examples๐Ÿ”—

Find open critical cases๐Ÿ”—

{
    "arguments": {
        "query": "severity = 10 AND closedAt is null",
        "pagination": {"offset": {"page": 1, "perPage": 20}}
    }
}

Search by title๐Ÿ”—

{
    "arguments": {
        "query": "title contains 'ransomware'",
        "pagination": {"offset": {"page": 1, "perPage": 50}}
    }
}

Filter by tag๐Ÿ”—

{
    "arguments": {
        "query": "tags contains 'malware' AND severity >= 6",
        "pagination": {"offset": {"page": 1, "perPage": 20}}
    }
}

Find recently updated cases๐Ÿ”—

{
    "arguments": {
        "query": "updatedAt >= '2024-08-14T00:00:00Z' | sort updatedAt desc",
        "pagination": {"offset": {"page": 1, "perPage": 20}}
    }
}

Assigned to specific user๐Ÿ”—

{
    "arguments": {
        "query": "assigneeId = '@customer'",
        "pagination": {"offset": {"page": 1, "perPage": 20}}
    }
}

Pagination๐Ÿ”—

Both offset (page-based) and cursor-based pagination are supported.

Offset Pagination๐Ÿ”—

{
    "pagination": {
        "offset": {
            "page": 1,
            "perPage": 20
        }
    }
}
  • page: 1-indexed page number (default: 1)
  • perPage: Results per page, max 100 (default: 20)

Cursor Pagination๐Ÿ”—

{
    "pagination": {
        "cursor": {
            "first": 20,
            "after": "cursor_value_here"
        }
    }
}
  • first: Forward page size, max 100 (default: 20)
  • after: Cursor from previous page's endCursor

Use last and before for backward traversal.

Important Notes๐Ÿ”—

  • No search by name at this time: You must filter by IDs (e.g., primaryStatusId, typeId), not names. Query caseTypes and casePrimaryStatuses first to get IDs for filtering.
  • Empty query: Omit query to retrieve all cases (default sort: newest first).
  • Default pagination: If pagination is omitted, defaults to page 1, 20 results.
  • Cursor strings are opaque: Do not parse cursor valuesโ€”use them as-is.

Next Steps๐Ÿ”—

For more information, see the Get Started with the Cases GraphQL API.