This trigger runs a workflow for every case whose investigation status changes to Ready to Investigate. That status marks the point where the alert that opened the case has finished processing, with its observables extracted and enriched.
Each event is the case that became ready.
Note: The workflow that processes alerts is what sets the status, once enrichment has finished. That is a stronger signal than the alert’s own processing_status, which turns Processed during deduplication, before enrichment has run.
Note: For long-text fields (e.g., Summary), the returned value will be a substring of the full content. To obtain the complete value, retrieve the entire case.
Note: Workflows based on this trigger will search for new events every minute.
Sample Event
Testing Workflows Triggered by a Case Event
When building a workflow triggered by a case event, the testing parameters include a “Fetch event” button. This button retrieves a recent case ID for testing purposes.
However, it’s important to note that the returned case ID may reference a case that has been deleted since the last polling interval. This behavior is expected and by design.
As a result, the fetched ID may not always return valid case data when used in subsequent steps.
Recommendation:
Builders should account for this scenario by implementing appropriate error handling in their workflows to manage cases where the retrieved ID is no longer valid. 
