Add artifacts to case(s) or case task(s)

After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.

Before you begin

Role required: admin

Note: Artifacts are available only to the existing cases. For observables and indicators, the artifacts can also be added or associated to a case from the import job using the Import Intelligence button. For more information on how to import see, Import Intelligence in TISC

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.

2. Click Threat Analyst Workbench icon.

3. Go to Case Management > All Cases.

   All the cases are displayed.

4. Select any case or case task.

5. Go to Artifacts tab.

   The associated artifacts are displayed as the related lists for that specific case or case task.

6. Link or Unlink the records from the case or case task.

   Note: For more information, see Link Threat Intel Related Records

   Following table lists the artifacts related lists related to the case(s) or case task(s):

• Roll up of MITRE Techniques from Artifacts to Case
  When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.
• Show MITRE ATT&CK Framework for a Case(s)
  Displays all the associated techniques of a case on the MITRE ATT&CK framework.

Parent Topic:Threat Analyst Workbench

Related topics

Workbench Overview

Creating cases using Threat Analyst Workbench

Summarize a Case with Now Assist for Threat Intelligence Security Center

Creating case task using Threat Analyst Workbench

Working with Investigation Canvas

Run Enrichment Actions within a case

Generate a Case Report using generative AI

Generate a Case Report using a template

Create a security incident from a TISC case

Upload Secure File Attachments

Using playbooks