> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Case From Alert

Create a case from an existing alert.

## Basic Parameters

<div className="integrations-table">
  | Parameter          | Description                                  |
  | ------------------ | -------------------------------------------- |
  | Alert ID           | The ID of the alert.                         |
  | Assignee           | User to assign the case to.                  |
  | Sharing Parameters | -                                            |
  | Status             | The status of the resource.                  |
  | Title              | A short, descriptive title for the resource. |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter       | Description                                                                                                                                                                                                                                                                                                                                                               |
  | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Case Template   | Name or id of the Case Template to use.                                                                                                                                                                                                                                                                                                                                   |
  | Custom Fields   | Custom fields as an array of objects.<br /><br />For more information about the `Custom Fields` parameter, visit [TheHive API documentation](https://docs.strangebee.com/thehive/api-docs/#tag/CustomField).                                                                                                                                                              |
  | Description     | The main detailed description and context for the resource.                                                                                                                                                                                                                                                                                                               |
  | End Date        | -                                                                                                                                                                                                                                                                                                                                                                         |
  | Flag            | Set to `true` to visually flag the resource in the user interface for attention.                                                                                                                                                                                                                                                                                          |
  | Observable Rule | -                                                                                                                                                                                                                                                                                                                                                                         |
  | PAP             | Prioritized Asset Profile, the severity level that is used to indicate the importance of an asset.<br /><br />White: The asset is not critical.<br /><br />Green: The asset is important, but not critical.<br /><br />Amber: The asset is critical.<br /><br />Red: The asset is essential.                                                                              |
  | Pages           | -                                                                                                                                                                                                                                                                                                                                                                         |
  | Severity        | The severity level of the resource.                                                                                                                                                                                                                                                                                                                                       |
  | Start Date      | -                                                                                                                                                                                                                                                                                                                                                                         |
  | Summary         | A brief summary of the resource.                                                                                                                                                                                                                                                                                                                                          |
  | TLP             | Traffic Light Protocol, a set of designations used to ensure that sensitive information is shared with the appropriate audience.<br /><br />CLEAR: unlimited formerly.<br /><br />GREEN: community-wide.<br /><br />AMBER: limited distribution.<br /><br />AMBER+STRICT: restricts sharing to the organization only.<br /><br />RED: personal for named recipients only. |
  | Tags            | An array of keywords (tags) as strings to categorize the resource.                                                                                                                                                                                                                                                                                                        |
  | Task Rule       | -                                                                                                                                                                                                                                                                                                                                                                         |
  | Tasks           | Additional tasks to create.                                                                                                                                                                                                                                                                                                                                               |
</div>

## Example Output

```json theme={"dark"}
{
	"_createdAt": 1640000000000,
	"_createdBy": "string",
	"_id": "string",
	"_type": "string",
	"_updatedAt": 1640000000000,
	"_updatedBy": "string",
	"alertDate": 1640000000000,
	"alertImportedDate": 1640000000000,
	"alertInProgressDate": 1640000000000,
	"alertNewDate": 1640000000000,
	"assignee": "string",
	"closedDate": 1640000000000,
	"customFields": [
		{
			"_id": "string",
			"name": "string",
			"order": 0,
			"type": "string",
			"value": ""
		}
	],
	"description": "string",
	"endDate": 1640000000000,
	"extraData": {},
	"flag": false,
	"handlingDuration": 0,
	"impactStatus": "string",
	"inProgressDate": 1640000000000,
	"newDate": 1640000000000,
	"number": 0,
	"pap": 0,
	"papLabel": "string",
	"severity": 0,
	"severityLabel": "string",
	"stage": "The value of the stage depends on the status of the case. Can be one of 'New' 'InProgress' or 'Closed'",
	"startDate": 1640000000000,
	"status": "string",
	"summary": "string",
	"tags": [
		"string"
	],
	"timeToAcknowledge": 0,
	"timeToDetect": 0,
	"timeToQualify": 0,
	"timeToResolve": 0,
	"timeToTriage": 0,
	"title": "string",
	"tlp": 0,
	"tlpLabel": "string",
	"userPermissions": [
		"string"
	]
}
```

## Workflow Library Example

[Create Case from Alert with Thehive and Send Results Via Email](https://library.blinkops.com/workflows/create-case-from-alert-with-thehive-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/create-case-from-alert-with-thehive-and-send-results-via-email/canvas" />
</div>