Skip to main content

Hi everyone,

I’m currently working on designing and implementing a Peer Review process.

I’ve created a scheduled task that runs weekly, and a playbook that is attached to this case.
However, I’m struggling to find a way to automatically pull a closed case for an analyst to review — for example, a case related to an attack in Azure — using specific filters.

Has anyone implemented something similar or found an efficient way to filter and assign closed cases for peer review?

Thanks in advance for your help!
Shalev

Hi,

 

As mentioned you could create a cron scheduled connector to spawn in a fictitious case at lets say Monday 08:00am.

 

You could create a playbook, which attaches to the above case with custom actions, such as one

which uses the endpoint:

 

/external/v1/search/CaseSearchEverything

With the following payload:

 

{"tags":[],"ruleGenerator":[],"caseSource":[],"stage":[],"environments":[],"assignedUsers":[],"products":[],"ports":[],"categoryOutcomes":[],"status":[],"caseIds":[],"incident":[],"importance":[],"priorities":[],"pageSize":50,"isCaseClosed":true,"title":"","startTime":"2025-10-23T00:00:00.000Z","endTime":"2025-10-23T23:59:59.999Z","requestedPage":0,"timeRangeFilter":365}



Which will output each Case ID that are closed, along with some data such as their closing time, you could have your playbook identify which of these were closed in the last week, output all of the case ids, title, tags, close reason (all of these present in the output from CaseSearchEverything) etc .

 

And then use the loop feature (I guess this would be better suited if there’s less then 100 cases a week being closed as this is the maximum for loops iirc), to loop through each case id, and have a manual question ‘Review Comment’, which you would enter the review comment, and maybe then email your comment to the Assigned User, maybe commenting on the case the comment (might only work if the case is open, so may conflict), using the endpoint /api/external/v1/casechat/{caseId} endpoint to do it via the casechat.

Hope it helps!

Kind Regards,

Ayman


Hi,

Thank you very much for your help! I’ll check it out and update you if I manage to get it working.

Really appreciate it!


Hi,

 

As mentioned you could create a cron scheduled connector to spawn in a fictitious case at lets say Monday 08:00am.

 

You could create a playbook, which attaches to the above case with custom actions, such as one

which uses the endpoint:

 

/external/v1/search/CaseSearchEverything

With the following payload:

 

{"tags":[],"ruleGenerator":[],"caseSource":[],"stage":[],"environments":[],"assignedUsers":[],"products":[],"ports":[],"categoryOutcomes":[],"status":[],"caseIds":[],"incident":[],"importance":[],"priorities":[],"pageSize":50,"isCaseClosed":true,"title":"","startTime":"2025-10-23T00:00:00.000Z","endTime":"2025-10-23T23:59:59.999Z","requestedPage":0,"timeRangeFilter":365}



Which will output each Case ID that are closed, along with some data such as their closing time, you could have your playbook identify which of these were closed in the last week, output all of the case ids, title, tags, close reason (all of these present in the output from CaseSearchEverything) etc .

 

And then use the loop feature (I guess this would be better suited if there’s less then 100 cases a week being closed as this is the maximum for loops iirc), to loop through each case id, and have a manual question ‘Review Comment’, which you would enter the review comment, and maybe then email your comment to the Assigned User, maybe commenting on the case the comment (might only work if the case is open, so may conflict), using the endpoint /api/external/v1/casechat/{caseId} endpoint to do it via the casechat.

Hope it helps!

Kind Regards,

Ayman

Thank you very much for your help! I’ll check it out and update you if I manage to get it working. Really appreciate it!