# Find Relevant Case

> Search for existing cases related to specific indicators or entities. Use to find correlation with other investigations before starting new analysis. Takes search terms and returns matching case IDs.

- Skill: `dandye/find-relevant-case` (Agent Skill)
- Install (CLI): `npx skillmds@latest add dandye/find-relevant-case`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dandye/find-relevant-case/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: dandye (https://skillmd.com/u/dandye)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/dandye/find-relevant-case

---


# Find Relevant Case Skill

Identify existing cases that may be related to the current investigation based on IOCs, hostnames, usernames, or other entities.

## Inputs

- `SEARCH_TERMS` - List of values to search for (e.g., `["198.51.100.10", "mikeross-pc", "jsmith"]`)
- *(Optional)* `CASE_STATUS_FILTER` - Filter by status: "Opened", "Closed" (default: "Opened")
- *(Optional)* `TIME_FRAME_HOURS` - Lookback period for case creation/update
- *(Optional)* `MAX_RESULTS` - Maximum cases to return

## Workflow

### Step 1: Construct Search Filter

Build a filter for `list_cases` based on search terms and filters.

**Note:** The `list_cases` tool may have limited ability to search within case entities. If direct entity search isn't supported, use broader filters and refine results.

### Step 2: Execute Search

```
secops-soar.list_cases(
    filter=constructed_filter,
    limit=MAX_RESULTS
)
```

### Step 3: Process Results

Extract case IDs and basic details (DisplayName, Priority) from results.

### Step 4: (Optional) Refine Results

If too many results, use `get_case_full_details` on a subset to verify entity presence:

```
secops-soar.get_case_full_details(case_id=candidate_case_id)
```

## Outputs

| Output | Description |
|--------|-------------|
| `RELEVANT_CASE_IDS` | List of case IDs that match the search |
| `RELEVANT_CASE_SUMMARIES` | Brief summaries (ID, name, priority) |
| `FIND_CASE_STATUS` | Success/failure status of the search |

## Limitations & Workarounds

The `list_cases` tool may not support direct entity searching. Alternatives:

1. **Broader filters** - Use time range, alert type, then manually review
2. **SIEM correlation** - Search SIEM for entity, check if events belong to a case
3. **Multiple searches** - Search each term separately, combine results