List Cases

List all cases with optional filtering.

Required permission to run this action: cases:view.

External Documentation

To learn more, visit the Artemis documentation.

Parameters

Parameter	Description
Cursor	The cursor used for pagination. Obtain this value from the next_cursor field in a previous response.
Judgement	Select the Artemis judgment to filter results by.
Limit	The maximum cases retrieved in a single execution. The valid range is 1-200.
Return All Pages	Automatically fetch all resources, page by page.
Severity	Select the case severity to filter results by.
Status	Select the case status to filter results by.

Example Output

{
	"data": [
		{
			"id": "case-9f8a7b6c",
			"status": "open",
			"severity": "high",
			"title": "Suspicious IAM policy escalation",
			"created_at": "2026-04-07T14:23:00Z",
			"updated_at": "2026-04-08T09:11:42Z",
			"closed_at": null,
			"finding_ids": [
				"finding-1a2b",
				"finding-3c4d"
			],
			"sourcetypes": [
				"aws--cloudtrail"
			],
			"observables": [
				{
					"type": "ip",
					"value": "203.0.113.42",
					"count": 3
				}
			],
			"assets": [
				{
					"type": "user",
					"value": "dev-deploy-role",
					"count": 2
				}
			],
			"verdict": null,
			"artemis_judgement": "True Positive"
		}
	],
	"next_cursor": "eyJvZmZzZXQiOjIwfQ==",
	"has_more": true
}

Workflow Library Example

List Cases with Artemis and Send Results Via Email

Preview this Workflow on desktop