cases

Creates, updates, deletes, gets or lists a cases resource.

Overview

Name	cases
Type	Resource
Id	aws.security_ir.cases

Fields

The following fields are returned by SELECT queries:

get_case

Name	Datatype	Description
actual_incident_start_date	string (date-time)	Response element for GetCase that provides the actual incident start date as identified by data analysis during the investigation.
case_arn	string	Response element for GetCase that provides the case ARN (pattern: <code>arn:aws:security-ir:\w+?-\w+?-\d+:[0-9]{12}:case/[0-9]{10}</code>)
case_attachments	array	Response element for GetCase that provides a list of current case attachments.
case_metadata	array	Case response metadata
case_status	string	Response element for GetCase that provides the case status. Options for statuses include Submitted | Detection and Analysis | Eradication, Containment and Recovery | Post-Incident Activities | Closed (Submitted, Acknowledged, Detection and Analysis, Containment, Eradication and Recovery, Post-incident Activities, Ready to Close, Closed)
closed_date	string (date-time)	Response element for GetCase that provides the date a specified case was closed.
closure_code	string	Response element for GetCase that provides the summary code for why a case was closed. (Investigation Completed, Not Resolved, False Positive, Duplicate)
created_date	string (date-time)	Response element for GetCase that provides the date the case was created.
description	string	Response element for GetCase that provides contents of the case description.
engagement_type	string	Response element for GetCase that provides the engagement type. Options for engagement type include Active Security Event | Investigations (Security Incident, Investigation)
impacted_accounts	array	Response element for GetCase that provides a list of impacted accounts.
impacted_aws_regions	array	Response element for GetCase that provides the impacted regions.
impacted_services	array	Response element for GetCase that provides a list of impacted services.
last_updated_date	string (date-time)	Response element for GetCase that provides the date a case was last modified.
pending_action	string	Response element for GetCase that identifies the case is waiting on customer input. (Customer, None)
reported_incident_start_date	string (date-time)	Response element for GetCase that provides the customer provided incident start date.
resolver_type	string	Response element for GetCase that provides the current resolver types. (AWS, Self)
threat_actor_ip_addresses	array	Response element for GetCase that provides a list of suspicious IP addresses associated with unauthorized activity.
title_	string	Response element for GetCase that provides the case title.
watchers	array	Response element for GetCase that provides a list of Watchers added to the case.

list_cases

Name	Datatype	Description
case_arn	string	(pattern: <code>arn:aws:security-ir:\w+?-\w+?-\d+:[0-9]{12}:case/[0-9]{10}</code>)
case_id	string	(pattern: <code>\d{10,32}.*</code>)
case_status	string	(Submitted, Acknowledged, Detection and Analysis, Containment, Eradication and Recovery, Post-incident Activities, Ready to Close, Closed)
closed_date	string (date-time)
created_date	string (date-time)
engagement_type	string	(Security Incident, Investigation)
last_updated_date	string (date-time)
pending_action	string	(Customer, None)
resolver_type	string	(AWS, Self)
title_	string

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_case	select	case_id, region		Returns the attributes of a case.
list_cases	select	region		Lists all cases the requester has access to.
create_case	insert	region, resolverType, title, description, engagementType, reportedIncidentStartDate, impactedAccounts, watchers		Creates a new case.
update_case_status	update	case_id, region, caseStatus		Updates the state transitions for a designated cases. Self-managed: the following states are available for self-managed cases. Submitted → Detection and Analysis Detection and Analysis → Containment, Eradication, and Recovery Detection and Analysis → Post-incident Activities Containment, Eradication, and Recovery → Detection and Analysis Containment, Eradication, and Recovery → Post-incident Activities Post-incident Activities → Containment, Eradication, and Recovery Post-incident Activities → Detection and Analysis Any → Closed AWS supported: You must use the CloseCase API to close.
update_resolver_type	update	case_id, region, resolverType		Updates the resolver type for a case. This is a one-way action and cannot be reversed.
update_case	update	case_id, region		Updates an existing case.
close_case	exec	case_id, region		Closes an existing case.
send_feedback	exec	case_id, result_id, region, usefulness		Send feedback based on response investigation action

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
case_id	string	Send feedback based on request caseID
region	string	AWS region (default: us-east-1)
result_id	string	Send feedback based on request result ID

SELECT examples

get_case

Returns the attributes of a case.

SELECT
actual_incident_start_date,
case_arn,
case_attachments,
case_metadata,
case_status,
closed_date,
closure_code,
created_date,
description,
engagement_type,
impacted_accounts,
impacted_aws_regions,
impacted_services,
last_updated_date,
pending_action,
reported_incident_start_date,
resolver_type,
threat_actor_ip_addresses,
title_,
watchers
FROM aws.security_ir.cases
WHERE case_id = '{{ case_id }}' -- required
AND region = '{{ region }}' -- required
;

list_cases

Lists all cases the requester has access to.

SELECT
case_arn,
case_id,
case_status,
closed_date,
created_date,
engagement_type,
last_updated_date,
pending_action,
resolver_type,
title_
FROM aws.security_ir.cases
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_case

Creates a new case.

INSERT INTO aws.security_ir.cases (
clientToken,
resolverType,
title,
description,
engagementType,
reportedIncidentStartDate,
impactedAccounts,
watchers,
threatActorIpAddresses,
impactedServices,
impactedAwsRegions,
tags,
region
)
SELECT 
'{{ clientToken }}',
'{{ resolverType }}' /* required */,
'{{ title }}' /* required */,
'{{ description }}' /* required */,
'{{ engagementType }}' /* required */,
'{{ reportedIncidentStartDate }}' /* required */,
'{{ impactedAccounts }}' /* required */,
'{{ watchers }}' /* required */,
'{{ threatActorIpAddresses }}',
'{{ impactedServices }}',
'{{ impactedAwsRegions }}',
'{{ tags }}',
'{{ region }}'
RETURNING
case_id
;

Manifest

# Description fields are for documentation purposes
- name: cases
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the cases resource.
  - name: clientToken
    value: "{{ clientToken }}"
  - name: resolverType
    value: "{{ resolverType }}"
    valid_values: ['AWS', 'Self']
  - name: title
    value: "{{ title }}"
  - name: description
    value: "{{ description }}"
  - name: engagementType
    value: "{{ engagementType }}"
    valid_values: ['Security Incident', 'Investigation']
  - name: reportedIncidentStartDate
    value: "{{ reportedIncidentStartDate }}"
  - name: impactedAccounts
    value:
      - "{{ impactedAccounts }}"
  - name: watchers
    value:
      - email: "{{ email }}"
        name: "{{ name }}"
        jobTitle: "{{ jobTitle }}"
  - name: threatActorIpAddresses
    value:
      - ipAddress: "{{ ipAddress }}"
        userAgent: "{{ userAgent }}"
  - name: impactedServices
    value:
      - "{{ impactedServices }}"
  - name: impactedAwsRegions
    value:
      - region: "{{ region }}"
  - name: tags
    value: "{{ tags }}"

UPDATE examples

update_case_status

Updates the state transitions for a designated cases. Self-managed: the following states are available for self-managed cases. Submitted → Detection and Analysis Detection and Analysis → Containment, Eradication, and Recovery Detection and Analysis → Post-incident Activities Containment, Eradication, and Recovery → Detection and Analysis Containment, Eradication, and Recovery → Post-incident Activities Post-incident Activities → Containment, Eradication, and Recovery Post-incident Activities → Detection and Analysis Any → Closed AWS supported: You must use the CloseCase API to close.

UPDATE aws.security_ir.cases
SET 
caseStatus = '{{ caseStatus }}'
WHERE 
case_id = '{{ case_id }}' --required
AND region = '{{ region }}' --required
AND caseStatus = '{{ caseStatus }}' --required
RETURNING
case_status;

update_resolver_type

Updates the resolver type for a case. This is a one-way action and cannot be reversed.

UPDATE aws.security_ir.cases
SET 
resolverType = '{{ resolverType }}'
WHERE 
case_id = '{{ case_id }}' --required
AND region = '{{ region }}' --required
AND resolverType = '{{ resolverType }}' --required
RETURNING
case_id,
case_status,
resolver_type;

update_case

Updates an existing case.

UPDATE aws.security_ir.cases
SET 
title = '{{ title }}',
description = '{{ description }}',
reportedIncidentStartDate = '{{ reportedIncidentStartDate }}',
actualIncidentStartDate = '{{ actualIncidentStartDate }}',
engagementType = '{{ engagementType }}',
watchersToAdd = '{{ watchersToAdd }}',
watchersToDelete = '{{ watchersToDelete }}',
threatActorIpAddressesToAdd = '{{ threatActorIpAddressesToAdd }}',
threatActorIpAddressesToDelete = '{{ threatActorIpAddressesToDelete }}',
impactedServicesToAdd = '{{ impactedServicesToAdd }}',
impactedServicesToDelete = '{{ impactedServicesToDelete }}',
impactedAwsRegionsToAdd = '{{ impactedAwsRegionsToAdd }}',
impactedAwsRegionsToDelete = '{{ impactedAwsRegionsToDelete }}',
impactedAccountsToAdd = '{{ impactedAccountsToAdd }}',
impactedAccountsToDelete = '{{ impactedAccountsToDelete }}',
caseMetadata = '{{ caseMetadata }}'
WHERE 
case_id = '{{ case_id }}' --required
AND region = '{{ region }}' --required;

Lifecycle Methods

close_case

Closes an existing case.

EXEC aws.security_ir.cases.close_case 
@case_id='{{ case_id }}' --required, 
@region='{{ region }}' --required
;

send_feedback

Send feedback based on response investigation action

EXEC aws.security_ir.cases.send_feedback 
@case_id='{{ case_id }}' --required, 
@result_id='{{ result_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"usefulness": "{{ usefulness }}", 
"comment": "{{ comment }}"
}'
;