What this endpoint does

Retrieves full details for one or more cases by their TaskIdentity IDs (format task:<UUID>). Call this after Cases: Search to get case details for the IDs it returns. The panels array controls which sections are returned: summary for metadata (title, status, priority, assignee), details for alert context and enrichment, log for activity history. Pass all three to get the complete case.

Response data

Returns an object with status and data fields, where data is a dictionary keyed by TaskIdentity — iterate over the map's values to access individual cases. Each case contains the requested panels. The summary panel includes triage metadata; the details panel carries enriched alert context with linked entities and risk rules; the log panel tracks status changes and comments over time.