Skip to main content
POST
/
cases
Search and list cases
curl --request POST \
  --url https://api.wirespeed.co/cases \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "size": 123,
  "page": 123,
  "filter": "<string>",
  "search": "<string>",
  "orderBy": "<string>",
  "orderDir": "asc",
  "days": 123,
  "startDate": "<string>",
  "endDate": "<string>",
  "statuses": [
    "NEW"
  ],
  "verdict": "MALICIOUS",
  "assetId": "<string>",
  "severity": "INFORMATIONAL",
  "assetType": "USER",
  "exclusionId": "<string>",
  "onlyWasEscalated": true,
  "onlyWasContained": true,
  "onlyWasMobile": true,
  "onlyWasMonitored": true,
  "onlyChatOps": true,
  "integrationPlatform": "aws",
  "hideDemoClients": true,
  "categoryClass": "ENDPOINT",
  "category": "OTHER__DIAGNOSTIC",
  "createdAt": {
    "gt": "<string>",
    "gte": "<string>",
    "lt": "<string>",
    "lte": "<string>"
  },
  "groupIds": [
    "<string>"
  ]
}
'
{
  "data": [
    {
      "id": "<string>",
      "sid": "<string>",
      "teamId": "<string>",
      "lastNotifiedClientAt": {},
      "status": "NEW",
      "createdAt": "<string>",
      "detectionSids": [
        "<string>"
      ],
      "testMode": true,
      "firstDetectionSourceIngestedAt": "<string>",
      "firstDetectionSourceDetectedAt": "<string>",
      "logs": [
        {
          "log": "<string>",
          "timestamp": "<string>",
          "debug": true
        }
      ],
      "contained": true,
      "reingested": true,
      "verdict": "MALICIOUS",
      "title": "<string>",
      "categories": [
        "OTHER__DIAGNOSTIC"
      ],
      "excludeFromMeans": true,
      "firstRun": true,
      "containsVIP": true,
      "containsHVA": true,
      "containsMobile": true,
      "severity": "<string>",
      "severityOrdinal": 123,
      "name": "<string>",
      "updatedAt": "<string>",
      "closedAt": "<string>",
      "verdictedAt": "<string>",
      "detectionCount": 123,
      "mttr": 123,
      "teamName": "<string>",
      "externalTicketId": "<string>",
      "externalTicketIntegrationId": "<string>",
      "autoContained": true,
      "respondedAt": "<string>",
      "platforms": [
        "<string>"
      ],
      "notes": "<string>",
      "clientNotified": true,
      "summary": "<string>",
      "hasPassedAql": true,
      "groups": "<string>"
    }
  ]
}

Documentation Index

Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
size
number
page
number
filter
string
orderBy
string
orderDir
enum<string>
Available options:
asc,
desc
days
number

Number of days for time-based filtering (1-365). Used by stats/widget endpoints to set the time window.

startDate
string

Start date (inclusive, ISO8601 string)

endDate
string

End date (inclusive, ISO8601 string)

statuses
enum<string>[]

Filter cases by status

Available options:
NEW,
PROCESSING,
ESCALATED,
HUNTING,
MONITORING,
CHATOPS,
CLOSED
verdict
enum<string>

Filter cases by verdict

Available options:
MALICIOUS,
SUSPICIOUS,
BENIGN
assetId
string

Filter cases involving a specific asset

severity
enum<string>

Filter cases by severity

Available options:
INFORMATIONAL,
LOW,
MEDIUM,
HIGH,
CRITICAL
assetType
enum<string>

Filter cases by asset type

Available options:
USER,
PROCESS,
USER_AGENT,
FILE,
ENDPOINT,
LOCATION,
IP,
DOMAIN
exclusionId
string

Filter cases by exclusion rule

onlyWasEscalated
boolean

Only include cases that were escalated

onlyWasContained
boolean

Only include cases that were contained

onlyWasMobile
boolean

Only include cases that involve mobile devices

onlyWasMonitored
boolean

Only include cases that had a monitor

onlyChatOps
boolean

Only include cases that involved chat ops

integrationPlatform
enum<string>

Filter cases by integration platform

Available options:
aws,
axonius,
bitwarden,
box,
checkpoint-firewall,
checkpoint-harmony,
cisco-catalyst,
cisco-duo,
cisco-meraki,
cisco-secure-access,
cisco-umbrella,
connectwise-psa,
crowdstrike-falcon,
darktrace,
email,
fortianalyzer,
fortinet,
generic-json,
generic-syslog,
google-alert-center,
google-directory,
google-security-center,
halcyon,
halo-itsm,
have-i-been-pwned,
horizon3,
hyas-protect,
ipinfo,
jamf-pro,
jamf-protect,
jira-cloud,
jira-data-center,
jumpcloud,
kandji,
manage-engine-ad-audit-plus,
microsoft,
microsoft-entra,
microsoft-teams,
microsoft-teams-v2,
mimecast,
odoo-helpdesk,
okta,
one-password,
orca-security,
palo-alto-networks-cortex,
picus,
ping-one,
reversing-labs,
safebreach,
sentinel-one,
service-now,
slack,
sms,
smtp,
sonic-wall,
stairwell,
thinkst-canary,
vectra,
watchguard-firebox,
windows-event-logs,
wirespeed,
wiz,
wordfence,
zscaler-zpa
hideDemoClients
boolean
categoryClass
enum<string>
Available options:
ENDPOINT,
IDENTITY,
CLOUD,
EMAIL,
NETWORK,
DATA,
POSTURE,
OTHER
category
enum<string>
Available options:
OTHER__DIAGNOSTIC,
OTHER__INFORMATIONAL_EVENT,
OTHER__WARNING,
OTHER__UNKNOWN,
OTHER__DECEPTION,
OTHER__CUSTOM_DETECTION,
CLOUD__INVOCATION,
CLOUD__DISCOVERY,
CLOUD__DATA_TRANSFER,
CLOUD__PERSISTENCE,
ENDPOINT__DISCOVERY,
ENDPOINT__EXECUTION,
ENDPOINT__LIVE_OFF_THE_LAND,
ENDPOINT__NUISANCE,
ENDPOINT__MALWARE_DISCOVERY,
ENDPOINT__MALWARE_EXECUTION,
ENDPOINT__LATE_STAGE,
ENDPOINT__PERSISTENCE,
ENDPOINT__REMOTE_MANAGEMENT,
ENDPOINT__LATERAL_MOVEMENT,
ENDPOINT__IMPACT,
ENDPOINT__EVASION,
ENDPOINT__EXPLOITATION,
ENDPOINT__SIMULATION,
ENDPOINT__PLANNED_CHANGE,
IDENTITY__LOGIN,
IDENTITY__REJECTED_MFA,
IDENTITY__DISCOVERY,
IDENTITY__BRUTE_FORCE,
IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE,
IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE,
IDENTITY__PERSISTENCE,
IDENTITY__ACCOUNT_COMPROMISE,
IDENTITY__SIMULATION,
NETWORK__INBOUND_CONNECTION,
NETWORK__OUTBOUND_CONNECTION,
NETWORK__PHISHING,
NETWORK__NOISY,
NETWORK__DISCOVERY,
EMAIL__PHISHING,
EMAIL__PHISHING_REPORTED,
EMAIL__EVASION,
EMAIL__MALWARE,
EMAIL__MALICIOUS_LINK,
EMAIL__GRAYMAIL,
EMAIL__SPAM,
EMAIL__BUSINESS_EMAIL_COMPROMISE,
DATA__DATA_TRANSFER,
DATA__DATA_SHARE,
POSTURE__POSTURE,
POSTURE__HEALTH
createdAt
object

Filter by creation date

groupIds
string[]

Filter cases by group IDs (OR) — matches cases with detections whose users or endpoints belong to any of the specified groups

Response

200 - application/json
data
object[]
required