Working with Case Sets

Use Case Sets to automate the creation of Case Management cases from a saved query on a recurring schedule. When wired for it, a Case Set also opens ITSM tickets per matching asset and reacts to follow-up events — for example, closing the ticket when the asset is remediated.

You can create and manage Case Sets from the AI Companion chat. The agent shows you a preview before making any changes and waits for your confirmation.

Required Permissions

• Case Management permissions to create and manage cases
• AI Agents write operations capability enabled for your role

Creating a Case Set

To create a Case Set, describe what you want in plain language:

• "Create a case set on the 'Unpatched Critical CVEs' query that opens a Jira ticket per asset."
• "Set up a case set that runs every day at 9 AM on my high-severity findings query."
• "Create a case set named 'KEV Tracking' on the KEV Devices query, case type Vulnerability."

Before creating the set, the agent shows you a preview that includes:

• The set's name
• The base saved query and asset type
• The case title, type, and priority
• The schedule
• Any ticket wiring and follow-up actions you configured

Review the preview carefully. Two things are final once the set is created and can't be changed: the set's name and its base query's asset type. To change either one later, duplicate the set under the new name and delete the original.

After you confirm, the set is created and listed on the Case Sets page. It doesn't run until its schedule triggers or you run it manually.

Schedule Options

When creating or updating a Case Set, you can set when it runs:

• Manual (default) — The set runs only when you ask the agent to run it.
• Every Discovery cycle — The set runs after each completed discovery cycle.
• Hourly / Daily / Weekly / Monthly / Once — Runs on a fixed interval.

You can also control what the set processes on each run:

• All results (default) — Processes every asset the query matches.
• New results only — Processes only assets added to the query results since the last run.

Bidirectional Ticket Flow

A Case Set can open ITSM tickets per matching asset and automatically respond to events. To set up the bidirectional flow, ask the agent to wire tickets and add a follow-up action:

• "Create a case set on 'Open Findings' that opens a Jira ticket per asset and closes the ticket when the asset is fixed."

The agent builds two components:

• Tickets — Opens one ticket per matching asset in the ITSM system you specify.
• Follow-up actions — Reacts to events after the tickets are created. The most common events are:
  • Asset removed — Fires when an asset leaves the query results (for example, when the finding is fixed). You can configure the action to update or close the linked ticket.
  • Ticket status changed — Fires when the ITSM ticket status changes. You can configure the action to update the case status in Axonius.

Editing a Case Set

To change an existing Case Set, describe what you want to update:

• "Update the 'KEV Tracking' case set to run every day at 8 AM instead of 9 AM."
• "Change the case priority in the 'Open Findings' set to P1."
• "Add a follow-up action to the 'Patch Tuesday' set that closes the Jira ticket when the asset is remediated."

You can update the base query (same asset type), the case title, type, and priority, the description, the schedule, the ticket leg, and the follow-up actions. The set's name and base query asset type remain locked.

The agent shows a preview before applying any changes. After you confirm, changes take effect from the next run.

Duplicating a Case Set

To create a copy of an existing Case Set — including its ticket wiring and follow-up actions — ask the agent to duplicate it:

• "Duplicate the 'KEV Tracking' case set as 'KEV Tracking - Windows Only'."

The duplicate copies the source set's full configuration. You can override the name, base query, case fields, and schedule. Ticket wiring and follow-up actions are copied as-is unless you specify changes.

Duplicating is the only way to rename a Case Set — create the duplicate under the new name, then delete the original.

Running a Case Set

By default, a Case Set runs on its schedule. To run it immediately:

• "Run the 'KEV Tracking' case set now."

The agent counts the assets the base query matches before running and shows you a confirmation. Running a Case Set creates or updates its case and, if configured, opens ITSM tickets. This can't be undone.

Deleting a Case Set

To delete a Case Set:

• "Delete the 'Old Remediation Tracking' case set."

Deleting a Case Set is irreversible. The set and its schedule are removed, and any run in progress is stopped. Cases and tickets the set already created are not affected.

For more information about updating cases created by a Case Set, see Updating Cases.