Automatically provision case management

During the automated provisioning of a new workspace, you can also set up case management, ensuring it's prepared for immediate use.

After the automatic creation of a workspace and the generation of an access token, you can configure the following case management settings:

• States
• Presets
• Resolution reasons

States

Automatically set case management states that match your work process and organizational needs.

1. Add the Set Case Management States step.
2. Define the states for the workspace (see step input example below). Remember that a custom state can only be added in the context of one of the default states: New, In progress, On hold, Resolved, or Closed. The custom state will inherit the characteristics of its corresponding default state (read more about custom states).
3. Add the Access token optional parameter and specify the access token previously generated for the new workspace.

An example of the Set Case Management States step input:

{
  "new": { // The core structure, consisting of five default states - new, in progress, on hold, resolved, and closed, must be preserved. A default state cannot be deleted.
    "name": "New", // The names of the default states can be modified. The name of a state must consist of at least two characters.
    "sub_states": [ // Each default state can have up to five custom sub-states. The custom states will inherit the characteristics of the default state.
      "substate_1", // The name of a state must consist of at least two characters.
      "substate_2",
      "substate_3",
      "substate_4",
      "substate_5"
    ]
  },
  "in_progress": {
    "name": "In Progress",
    "sub_states": [
      "substate_1",
      "substate_2",
      "substate_3",
      "substate_4",
      "substate_5"
    ]
  },
  "on_hold": {
    "name": "On Hold",
    "sub_states": [
      "substate_1",
      "substate_2",
      "substate_3",
      "substate_4",
      "substate_5"
    ]
  },
  "resolved": {
    "name": "Resolved",
    "sub_states": [
      "substate_1",
      "substate_2",
      "substate_3",
      "substate_4",
      "substate_5"
    ]
  },
  "closed": {
    "name": "Closed",
    "sub_states": [
      "substate_1",
      "substate_2",
      "substate_3",
      "substate_4",
      "substate_5"
    ]
  }
}

Presets

Automatically set case management presets to ensure that the desired views of the Cases page are available.

1. Add the Set case management presets step.
2. Define the presets for the workspace. Give each preset a unique name and specify the filters and their values (see step input example below).
   Note

   • The Created at filter can accept 2 types of values. Use relative to specify a duration relative to the current time, or use from and to to define a specific time window.
   • Custom fields can also be specified as filters.
3. Add the Access token optional parameter and specify the access token previously generated for the new workspace.

An example of the Set Case Management Presets step input:

[
  {
    "name": "preset name", // Assign a meaningful name for the preset. While this example demonstrates a single preset, you can easily expand it to define multiple presets. The presets listed in this step input will replace any existing custom presets in the workspace without affecting the default presets.
    "filters": { // Define which filters to include in the preset and set the values for each (select from the options available in the Cases page UI).
      "severities": [
        "High",
        "Medium"
      ],
      "assignees": [
        "john@torq.io",
        "jane@torq.io"
      ],
      "created_at": { // Use the "relative" value to indicate a duration relative to the present moment, or opt for "from" and "to" (similar to the SLA filter value shown below) to establish a precise time range.
        "relative": "Last 7 days"
      },
      "sla_range": {
        "from": 0.8,
        "to": 1
      },
      "categories": [
        "AppSec",
        "Malware"
      ],
      "tags": [
        "AI-Assisted",
        "3rd-party"
      ],
      "custom_fields": [ // Custom fields can serve as filters. Specify the custom field key and the desired value. It's important to note that, unlike other filters, you can only specify one possible value for the custom field key to filter cases.
        {
          "key": "Cloud Instance Id",
          "value": "EC2-324243423"
        }
      ],
      "pending_tasks": true
    }
  }
]

Resolution reasons

Automatically set the case management resolution reasons that analysts can specify when closing or resolving a case.

1. Add the Set case management resolution reasons step.
2. Specify the resolution reasons for the workspace.
3. Add the Access token optional parameter and specify the access token previously generated for the new workspace.