Find Relevant Case Skill

Identify existing cases that may be related to the current investigation based on IOCs, hostnames, usernames, or other entities.

Inputs

• SEARCH_TERMS - List of values to search for (e.g., ["198.51.100.10", "mikeross-pc", "jsmith"])
• (Optional) CASE_STATUS_FILTER - Filter by status: "Opened", "Closed" (default: "Opened")
• (Optional) TIME_FRAME_HOURS - Lookback period for case creation/update
• (Optional) MAX_RESULTS - Maximum cases to return

Workflow

Step 1: Construct Search Filter

Build a filter for list_cases based on search terms and filters.

Note: The list_cases tool may have limited ability to search within case entities. If direct entity search isn't supported, use broader filters and refine results.