Cases

Cases

How to work with LimaCharlie Cases (ext-cases extension). Cases are the SOC triage and investigation tracking system. For investigation methodology, see composed skills.

Case Lifecycle

new -> in_progress -> resolved -> closed
resolved -> in_progress (reopen)
closed -> in_progress (reopen)

CLI Commands

List Cases

limacharlie case list --oid <oid> --output yaml

# Filter by status
limacharlie case list --status new --status in_progress --oid <oid> --output yaml

# Filter by severity
limacharlie case list --severity critical --severity high --oid <oid> --output yaml

# Filter by assignee
limacharlie case list --assignee analyst@example.com --oid <oid> --output yaml

# Filter by sensor
limacharlie case list --sensor-id <sid> --oid <oid> --output yaml

# Search
limacharlie case list --search <term> --oid <oid> --output yaml

Get Case

limacharlie case get --case-number <number> --oid <oid> --output yaml

Create Case (Manual)

Create a case without a detection trigger:

limacharlie case create --severity <severity> --summary "Description of the case" --oid <oid> --output yaml

Update Case

# Status
limacharlie case update --case-number <number> --status in_progress --oid <oid> --output yaml

# Severity
limacharlie case update --case-number <number> --severity high --oid <oid> --output yaml

# Classification
limacharlie case update --case-number <number> --classification true_positive --oid <oid> --output yaml

# Summary and conclusion (supports Markdown)
limacharlie case update --case-number <number> \
  --summary "Attack narrative..." \
  --conclusion "Assessment and recommendations..." \
  --classification true_positive \
  --status resolved \
  --oid <oid> --output yaml

Add Notes

limacharlie case add-note --case-number <number> --type analysis \
  --content "Investigation finding..." --oid <oid> --output yaml

# Long notes via file
limacharlie case add-note --case-number <number> --type analysis \
  --input-file /tmp/note.md --oid <oid> --output yaml

Note content supports Markdown formatting.

Valid note types: general, analysis, remediation, recommendation, escalation, handoff, to_stakeholder, from_stakeholder

Notes support an is_public flag — when true, the note may be shared externally.

Add Entities (IOCs)

limacharlie case entity add --case <number> \
  --type ip --value "203.0.113.50" \
  --verdict malicious \
  --note "C2 server - 60+ beacon connections observed" \
  --oid <oid> --output yaml

Valid entity types: ip, domain, hash, url, user, email, file, process, registry, other

Search Entities Across Cases

limacharlie case entity search --type ip --value "203.0.113.50" --oid <oid> --output yaml

Add Telemetry References

limacharlie case telemetry add --case <number> \
  --atom "<event-atom>" --sid "<sensor-id>" \
  --event-type "NEW_PROCESS" \
  --ts "<event-timestamp>" \
  --verdict malicious \
  --note "Malicious process execution" \
  --oid <oid> --output yaml

Valid verdicts: malicious, suspicious, benign, unknown, informational

Add Detections to Case

limacharlie case detection add --case <number> \
  --detection '<full detection JSON>' \
  --oid <oid> --output yaml

Add Artifacts

limacharlie case artifact add --case <number> \
  --path "/forensics/memory/dump.dmp" \
  --source "DESKTOP-001" \
  --verdict malicious \
  --note "Memory dump from compromised host" \
  --oid <oid> --output yaml

Tags

limacharlie case tag add --case-number <number> --tag phishing --oid <oid> --output yaml
limacharlie case tag remove --case-number <number> --tag <tag> --oid <oid> --output yaml
limacharlie case tag set --case-number <number> --tag <tag> --oid <oid> --output yaml

Merge Cases

When multiple cases are part of the same incident:

limacharlie case merge --target <primary_number> --sources <num2>,<num3> --oid <oid> --output yaml

Source cases transition to closed with merged_into_case_id set.

Export

# JSON to stdout
limacharlie case export --case-number <number> --oid <oid> --output yaml

# Full data export to directory
limacharlie case export --case-number <number> --with-data ./case-export --oid <oid>

Bulk Operations

limacharlie case bulk-update --numbers <num1>,<num2> \
  --status closed --classification false_positive \
  --oid <oid> --output yaml

Dashboard and Reporting

# Case count summary
limacharlie case dashboard --oid <oid> --output yaml

# SOC performance report
limacharlie case report --from 2025-01-01T00:00:00Z --to 2025-02-01T00:00:00Z --oid <oid> --output yaml

Schema Reference