Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Security incidents in cases

In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.

  • Create a case from security incidents
    In Security Incident Response, you can create cases from security incidents. After the security incidents have been used to create a new case, you can use Security Case Management to analyze the data.
  • Add security incidents to an existing case
    You can add security incidents to one or more existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.

Parent Topic:Case creation from security artifacts

Related topics

IoCs and observables in cases

Configuration items in cases

Affected users in cases