Summarize a Case with Now Assist for Threat Intelligence Security Center
Use Now Assist for Threat Intelligence Security Center to generate a concise summary of a case, including its key findings and recommended next steps.
Before you begin
Important: Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see Now Assist skills, agents, and agentic workflows on by default.
Role required: sn_sec_tisc.analyst
About this task
The Case Summarization skill analyzes the content of a threat case — including linked threat intelligence objects, notes, and activity history — and generates a concise summary. Analysts can review the summary and quickly understand the current state of the case.
Procedure
Navigate to Workspaces > Threat Intelligence Security Center.
Select the Threat Analyst Workbench icon.
In Case Management, open the case you want to summarize.
You can use case summarization for all case statuses, except Draft and Cancelled.
In the Details tab, select Summarize.
You can also use the Summarize Case option from the Now Assist panel.
Depending on the available data, the summary includes one or more of the following sections surfacing the prioritized details:
- Case overview: Available for all summaries. Contains a brief overview and case details.
- Findings: Contain details, such as, Key insights, Top risk indicators, Assets and Services.
- Key actions taken: Lists the actions performed by analysts on the case.
- Recommended next steps: Lists the possible case mitigation, subsequent procedures, or other next steps.
- Select Share to open the summary in an editable window and add or remove summary details, and select Save to work notes.
Parent Topic:Threat Analyst Workbench
Related topics
Creating cases using Threat Analyst Workbench
Creating case task using Threat Analyst Workbench
Working with Investigation Canvas
Add artifacts to case(s) or case task(s)
Run Enrichment Actions within a case
Generate a Case Report using generative AI
Generate a Case Report using a template
Create a security incident from a TISC case