---
title: "Comments"
---

{/* Auto-generated by scripts/generate_core_action_docs.py; do not edit by hand. */}

## `core.cases.create_comment`

Add a comment to an existing case.

### Inputs

<ParamField path="case_id" type="string" required>

The ID of the case to comment on.

</ParamField>

<ParamField path="content" type="string" required>

The comment content.

</ParamField>

<ParamField path="parent_id" type="string | null">

The ID of the parent comment if this is a reply.

Default: `null`.

</ParamField>

<ParamField path="workflow_id" type="string | null">

The ID of the workflow to run when the comment is created.

Default: `null`.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```

## `core.cases.reply_to_comment`

Reply to a top-level case comment.

### Inputs

<ParamField path="case_id" type="string" required>

The ID of the case containing the parent comment.

</ParamField>

<ParamField path="content" type="string" required>

The reply content.

</ParamField>

<ParamField path="parent_comment_id" type="string" required>

The ID of the top-level comment to reply to.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```

## `core.cases.update_comment`

Update an existing case comment.

### Inputs

<ParamField path="comment_id" type="string" required>

The ID of the comment to update.

</ParamField>

<ParamField path="content" type="string" required>

The updated comment content.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```

## `core.cases.list_comments`

List all comments for a case.

### Inputs

<ParamField path="case_id" type="string" required>

The ID of the case to get comments for.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```

## `core.cases.list_comment_threads`

List comment threads for a case.

### Inputs

<ParamField path="case_id" type="string" required>

The ID of the case to get comment threads for.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```

## `core.cases.get_comment_thread`

Get the full thread for a comment ID.

### Inputs

<ParamField path="comment_id" type="string" required>

The ID of a comment within the thread.

</ParamField>

### Examples

**Manage case comments**

```yaml
- ref: create_comment
  action: core.cases.create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    content: "Initial triage started."
- ref: reply_to_comment
  action: core.cases.reply_to_comment
  depends_on:
    - create_comment
  args:
    case_id: ${{ TRIGGER.case_id }}
    parent_comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Added IOC context."
- ref: update_comment
  action: core.cases.update_comment
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
    content: "Initial triage started. Waiting on endpoint data."
- ref: list_comments
  action: core.cases.list_comments
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: list_comment_threads
  action: core.cases.list_comment_threads
  args:
    case_id: ${{ TRIGGER.case_id }}
- ref: get_comment_thread
  action: core.cases.get_comment_thread
  depends_on:
    - create_comment
  args:
    comment_id: ${{ ACTIONS.create_comment.result.id }}
```
