Get Case

Retrieve the specified case’s details.

Required permission to run this action: cases:view.

External Documentation

To learn more, visit the Artemis documentation.

Parameters

Parameter	Description
Case ID	The ID of the case to retrieve details for. Can be obtained by the List Cases action.

Example Output

{
	"id": "case-9f8a7b6c",
	"status": "open",
	"severity": "high",
	"title": "Suspicious IAM policy escalation",
	"created_at": "2026-04-07T14:23:00Z",
	"updated_at": "2026-04-08T09:11:42Z",
	"closed_at": null,
	"finding_ids": [
		"finding-1a2b",
		"finding-3c4d"
	],
	"sourcetypes": [
		"aws--cloudtrail"
	],
	"observables": [
		{
			"type": "ip",
			"value": "203.0.113.42",
			"count": 3
		}
	],
	"assets": [
		{
			"type": "user",
			"value": "dev-deploy-role",
			"count": 2
		}
	],
	"verdict": null,
	"artemis_judgement": "True Positive"
}

Workflow Library Example

Get Case with Artemis and Send Results Via Email

Preview this Workflow on desktop