Skip to content

Cases

Cases enable you to regroup your investigation findings across multiple perimeters, alerts and analysts and share your results with your end-users in an efficient manner.

You can either create a new case from an existing alert or add alerts to an existing case.

Cases listing

The listing page lists all the cases across your community. They can be listed following multiple filters:

  • Status (open or closed cases)
  • Assigned to or Created by
  • Tags associated

You can also sort your cases depending on:

  • Last edition (default)
  • Creation date
  • Priority (low, medium, high)

Create a case

To create a new case, you can:

  1. Open the Cases page
  2. Click on + Case button
  3. Provide a title and a description (mandatory fields)
  4. Select an assignee, the person will receive
  5. Define a priority
  6. Add tags if needed
  7. Click on Create

Edit a case

To edit a case, you just have to click on a case and reach the edit button available on the details view. The case must be open in order to be edited.

Case details

The Case details page contains multiple elements. In the header, you can find the name of the case, the person that created it, the last edition date, a tag with the case ID that you can easily copy by clicking on it, the priority and the status. You also have two tabs:

  • Details tab
    • Authors, the community and the dates of creation and edition of the case
    • A description of the case that uses Markdown to enable you to format your text
    • A timeline
    • A comment button to publish comments that will show on the timeline section
  • Alerts tab
    • A table that lists all alerts associated to the case
    • A button to add alerts to the case

Add alerts to case

To add alerts to case, you can either:

  • Access the detailed page of an alert and click on the button Add to case
  • Access the detailed page of a case, click on the alerts tab and reach the button Add alerts

Tip

To add multiple alerts to a case, we recommend you copy the ID of your case in the case details page, then paste it in the modal that shows up after clicking on the Add to alerts modal.