Cases

Cases are the investigation workspace for alerts that need human attention.

Find a case

Open Cases and choose Open cases or Closed cases. Expand Filters to filter by case date, priority, impact, urgency, tag, or description keywords. The cases chart groups results by day and priority; select a bar segment to apply that date and priority filter. The list is paginated and can show 25, 50, 100, 150, or 200 rows per page. The page may limit the result to the first 500 cases; refine filters when you see that notice.

Select a case to open its details. Select a tag to filter the list by that tag, or use the share action to copy a link that takes an authorized user directly to the case.

Work a case

On the case list and detail pages you can:

• read the description, alert context, tags, comments, and history;
• edit comma-separated tags and save them for later filtering;
• view AI-generated remediation and the implementation plan, then edit the remediation in Markdown;
• escalate the case with a required comment; and
• close the case with a required Markdown comment and a Handled or No issue resolution.

Closing or escalating a case records the action and comment for later review. Some alerts can also be closed automatically when the account’s configured conditions are met.

Step-by-step: find and triage a case

1. Confirm the selected account, then select Open cases or Closed cases.
2. Expand Filters and set the date range, priority, impact, urgency, tag, or description keyword. Select Apply when the filters are ready.
3. Optionally select a chart bar segment to filter by its day and priority.
4. Select a page size and use Previous or Next to move through the results.
5. Select the case title to open its detail page. Review its priority, impact, urgency, description, alert context, tags, comments, and history.
6. Select Edit tags, enter comma-separated tags, and save. Avoid duplicate tags; SIEM+ removes case-insensitive duplicates.
7. Open Remediation to review the implementation plan, edit the remediation in Markdown, preview it, and select Save.
8. If another team must act, open Escalate, choose Low, Medium, High, or Critical, enter a comment, and select Escalate case.
9. When the investigation is complete, open Close case, choose Handled or No issue, enter the required closing comment, and select Close case.
10. Use Share only after confirming the account and case; SIEM+ copies an authorized case URL to the clipboard.

The case history records comments, escalations, remediation changes, and closure activity. Recheck the account selector before sharing a case link or closing the case.

Use the selected account

Cases are scoped to the selected account. Before sharing or closing a case, confirm the account selector in the header.