Creating a case
Cases are created by escalating an alert or a correlation, from a playbook's escalate action, or by hand from Cases › New. Escalation carries over the alert's notes, events, hosts, indicators and any staged responses.
Categories
Each case has a category, chosen at creation from the list in Settings › Case categories. A category carries a write-up structure and a task template, so a "credential theft" case opens with the tasks a credential theft needs. See Case categories.
Tabs
| Tab | What it holds |
|---|---|
| Details | Summary, severity, status, category, the write-up, the brief customers see in the portal, scope and linked alerts. |
| People & work | The case team with roles (lead, co-lead, investigator, responder, observer), and assignment of the case's alerts. |
| Tasks | The checklist from the category template plus anything you add. |
| Artifacts | Indicators found in the case, checked against the organization's other cases. A match elsewhere is shown here. |
| Timeline | Case activity and the log events from the linked alerts, in order. |
| War room | Conversation among the people on the case, with @-mentions and pasted images. |
A case moves through open, investigating, contained, eradicated, recovered and closed.
Closing
A case cannot be closed while tasks are open: complete or cancel each one first. Closing is recorded on the case timeline and in the audit log.
Reporting
From a case, Report › Open a post-incident report starts a report with the case attached. Download markdown gives a quick export. See Reports.