Skip to main content
Note Workflows based on this trigger will search for new events every minute.

​
Parameters

ParameterDescription
Fields NamesThe names of the fields to trigger the workflow on.

​
Sample Event

{
	"alert_ids": null,
	"attachment_ids": null,
	"auto_id": 1,
	"case_id": "INC-00001",
	"case_ids": null,
	"case_manager": null,
	"case_tags": null,
	"close_reason": null,
	"closed_at": null,
	"closed_by": null,
	"closed_by_automation": false,
	"collaborators": null,
	"created_at": 1732194432630,
	"created_by": "test@blinkops.com",
	"id": "bb2a5fcc-423b-4536-8b7a-63a547216579",
	"observable_ids": null,
	"mitre_attack": null,
	"name": "New Case",
	"observable_ids": null,
	"overview": null,
	"severity": 1,
	"sla": null,
	"sla_expiry": null,
	"status": "OPEN",
	"summary": null,
	"task_ids": null,
	"type": null,
	"updated_at": 1732194441635,
	"updated_by": "test@blinkops.com",
	"vendors": null
}

​
Testing Workflows Triggered by a Case Event

When building a workflow triggered by a case event, the testing parameters include a “Fetch event” button. This button retrieves a recent case ID for testing purposes. However, it’s important to note that the returned case ID may reference a case that has been deleted since the last polling interval. This behavior is expected and by design. As a result, the fetched ID may not always return valid case data when used in subsequent steps. Recommendation: Builders should account for this scenario by implementing appropriate error handling in their workflows to manage cases where the retrieved ID is no longer valid.