Skip to main content

Query Actions

Query a Case Management Table

Query a Case Management Table by filling in the following parameters in the step.

ParameterDescription
Table NameType of Table: Case, IOC, Alert, Attachment or Custom Table
FieldsField Types
Condition (Optional)Condition that compares two Case Management table field values.
Advanced-Limit (Optional)Query Limit
Thumbnail

Query a Case Management Table using SQL

Query a Case Management Table using SQL by filling in the following parameters in the step.

ParameterDescription
SQL QueryThe SQL Query
Output FormatOutput Format Types: Table, CSV or JSON
note

Please note that you need to use table and column names and not display names. Down below, is the full list of table and column names mapped to their display names.

  • To query associated cases linked to fields across different tables, employ the following SQL query:
SELECT *
FROM cases c
JOIN <insert_table_name> ON c.id::text = ANY(<inserted_table_name>.<linked_entity_column_name);
note

Replace <insert_table_name> and <inserted_table_name> with the name of the table where the associated cases are linked to fields.

For example, to get all cases and the IOCs attached to them:

SELECT *
FROM cases c
JOIN iocs i ON c.id::text = ANY(i.case_ids);

List of tables

Cases

NameDisplay Name
casesCases
case_idCase ID
nameName
severitySeverity
typeCase Type
case_tagsTags
slaSLA
case_managerCase Manager
collaboratorsCollaborators
statusStatus
overviewOverview
created_atCreated At

IOCS

NameDisplay Name
iocsIOCs
ioc_idIOC ID
case_idsLinked Cases
alerts_idsLinked Alerts
ioc_idsLinked IOCS
nameName
descriptionDescription
typeIOC Type
valueValue
created_atCreated At

Alerts

NameDisplay Name
alertsAlerts
alert_idAlert ID
case_idsLinked Cases
nameName
descriptionDescription
severitySeverity
typeAlert Type
vendorVendor
eventEvent
created_atCreated At

Attachments

NameDisplay Name
attachmentsAttachments
attachment_idAttachment ID
case_idsLinked Cases
nameName
descriptionDescription
typeAttachment Type
attachmentAttachment
created_atCreated At

Custom Tables

If you're using custom tables, please follow the Query a Table Using SQL docs to fetch the correct table scheme. You can get the full table name via the Copy Table ID button:

Thumbnail
Thumbnail