Actions23
- Case Actions
- Security Event Actions
- Report Actions
- IOC Actions
IOC → Get for Case
AI-generatedSummary
Retrieve all Indicators of Compromise (IOCs) associated with a specific case by providing its Case ID.
Inputs
- Case ID (required) — The unique identifier of the case for which to fetch associated IOCs.
Output shape
a list of IOC records associated with the specified case
Returns an array of IOC objects corresponding to the case ID provided. Each item in the list represents an IOC linked to the case. Handles one Case ID per execution call.
Examples
Example 1: Fetch IOCs for an incident investigation case
Set Resource to 'IOC', Operation to 'Get for Case', and provide the Case ID of the investigation.