Add to Case
Add observables, indicators, or other objects to the case.
Before you begin
Role required: sn_sec_tisc.analyst
Following is the procedure that shows how to add a case to an observable record.
Procedure
Navigate to Workspaces > Threat Intelligence Security Center > Threat Intel Library > Observables > All Observables.
Select the observable(s).
Click Add to Case button.
This displays only the cases where the record is not already associated.
Add to Case
Verify if you want to add the record to the existing cases and if so select the exiting case otherwise click Create New Case.
Create a new case by entering the following information.
| Field | Description |
|---|---|
| Case ID | A unique identifier for the case. This is system generated ID. |
| Short Description | Summary of the request or issue that is being investigated or a short description. |
| Case Type | Select the type of case being investigated. The possible options for the investigation are: - Threat Hunting - Request for Information - Vulnerability Management Case - Compliance Case - Incident Response Case - Collaboration Case - Others |
| Priority | An assessment of the severity of the request or issue. |
| Assignment Group | The assigned group responsible for working on the case. |
| Assigned to | The Analyst who is responsible for working on a case. |
Click Create if you are creating a new case.
Note: The new case is added to the existing case list.
Select the newly added case(s).
Click Add.
An information message is displayed that the selected records are added to case(s) successfully.
Parent Topic:Observables