Cases
Cases enable you to regroup your investigation findings across multiple perimeters, alerts and analysts and share your results with your end-users in an efficient manner.
You can either create a new case from an existing alert or add alerts to an existing case.
Cases listing
The listing page lists all the cases across your community. They can be listed following multiple filters:
- Status (open or closed cases)
- Assigned to or Created by
- Tags associated
You can also sort your cases depending on:
- Last edition (default)
- Creation date
- Priority (low, medium, high)
Create a case
To create a new case, you can:
- Open the Cases page
- Click on
+ Case
button - Provide a title and a description (mandatory fields)
- Select an assignee, the person will receive
- Define a priority
- Add tags if needed
- Click on
Create
Edit a case
To edit a case, you just have to click on a case and reach the edit
button available on the details view.
The case must be open in order to be edited.
Case details
The Case details page contains multiple elements. In the header, you can find the name of the case, the person that created it, the last edition date, a tag with the case ID that you can easily copy by clicking on it, the priority and the status. You also have two tabs:
- Details tab
- Authors, the community and the dates of creation and edition of the case
- A description of the case that uses Markdown to enable you to format your text
- A timeline
- A comment button to publish comments that will show on the timeline section
- Alerts tab
- A table that lists all alerts associated to the case
- A button to add alerts to the case
Add alerts to case
To add alerts to case, you can either:
- Access the detailed page of an alert and click on the button
Add to case
- Access the detailed page of a case, click on the alerts tab and reach the button
Add alerts
Tip
To add multiple alerts to a case, we recommend you copy the ID of your case in the case details page, then paste it in the modal that shows up after clicking on the Add to alerts modal.