Cases

Cases are the investigation workspace for alerts that need human attention.

Find a case

Open Cases and choose Open cases or Closed cases. Expand Filters to filter by case date, priority, impact, urgency, tag, or description keywords. The cases chart groups results by day and priority; select a bar segment to apply that date and priority filter. The list is paginated and can show 25, 50, 100, 150, or 200 rows per page. The page may limit the result to the first 500 cases; refine filters when you see that notice.

Select a case to open its details. Active tag filters remain visible above the list, and the cases chart follows the filtered cases currently shown. Select a tag to filter the list by that tag, or use the share action to copy a link that takes an authorized user directly to the case.

Work a case

On the case list and detail pages you can:

• read the description, alert context, tags, comments, and history;
• switch between Overview, Alerts, and Comments on a case detail page;
• edit comma-separated tags and save them for later filtering;
• view AI-generated remediation and a structured implementation plan, then edit the remediation in Markdown;
• review the alert count and, when available, linked or live matching alerts with their time, type, datasource, source, status, and stored matching window;
• hover over an indicator of compromise (IOC) to view its account-scoped summary when one is available;
• escalate the case with a required comment; and
• close the case with a required Markdown comment and a Handled or No issue resolution.

Closing or escalating a case records the action and comment for later review. Some alerts can also be closed automatically when the account’s configured conditions are met.

Step-by-step: find and triage a case

1. Confirm the selected account, then select Open cases or Closed cases.
2. Expand Filters and set the date range, priority, impact, urgency, tag, or description keyword. Select Apply when the filters are ready.
3. Optionally select a chart bar segment to filter by its day and priority.
4. Select a page size and use Previous or Next to move through the results.
5. Select the case title to open its detail page. Review its priority, impact, urgency, description, alert context, tags, comments, and history.
6. Select Edit tags, enter comma-separated tags, and save. Avoid duplicate tags; SIEM+ removes case-insensitive duplicates.
7. Open Remediation to review the implementation plan, edit the remediation in Markdown, preview it, and select Save.
8. If another team must act, open Escalate, choose Low, Medium, High, or Critical, enter a comment, and select Escalate case.
9. When the investigation is complete, open Close case, choose Handled or No issue, enter the required closing comment, and select Close case.
10. Use Share only after confirming the account and case; SIEM+ copies an authorized case URL to the clipboard.

The case history records comments, escalations, remediation changes, and closure activity. Recheck the account selector before sharing a case link or closing the case.

The Alerts tab loads alert data on demand. It can show linked alerts or alerts that currently match the case’s stored entity, datasource, technique, target, and time-window filter. Results are displayed 50 at a time with Previous, Next, and Refresh controls. The structured implementation plan shows its investigation objective, numbered actions, exit conditions, investigation query when present, and expected outcome or decision criteria. Legacy Markdown plans continue to render as Markdown.

Use the selected account

Cases are scoped to the selected account. Before sharing or closing a case, confirm the account selector in the header.