Case Management

Case management is where SOC analysts investigate, triage, and respond to security incidents. Detection alerts flow into cases automatically, so related alerts, entities, and context land in one place instead of an undifferentiated alert queue.

Key Features

Case-Centric Workflow

• Alerts flow into Cases: Detection alerts are automatically grouped into cases based on configurable rules
• Single pane of investigation: All related alerts, entities, and context in one place
• AI-powered triage: Get AI-generated summaries and recommendations

Automatic Alert Grouping

• Group alerts by host, user, IP, or detection rule
• Configurable time windows control how long a case stays open for new alerts
• Host and User grouping are enabled by default; IP and Rule grouping ship disabled

Entity Extraction & Visualization

• Automatic extraction of users, hosts, IPs, domains, and file hashes
• Interactive entity relationship graph
• One-click pivot to search for any entity

Integrated Investigation Notebooks

• Every assigned case gets an investigation notebook automatically
• Case lifecycle events (status changes, assignments, merges) are mirrored into the notebook
• The Investigation tab shows a unified timeline: searches, notes, AI analysis, and case events in one place
• AI summaries include case metadata for richer context

SOC Metrics & Audit Trail

• Every case action is logged for compliance and metrics
• Query audit events to build dashboards showing MTTD, MTTR, analyst workload
• Full audit trail of who did what, when

Case Workflow

┌──────────────────────────────────────────────────────────────────────────┐
│                           CASE LIFECYCLE                                  │
├──────────────────────────────────────────────────────────────────────────┤
│                                                                           │
│   ┌─────────┐     ┌─────────────┐     ┌─────────┐     ┌──────────┐      │
│   │  Open   │────▶│ In Progress │────▶│ Pending │────▶│ Resolved │      │
│   └─────────┘     └─────────────┘     └─────────┘     └──────────┘      │
│        │                │                   │               │            │
│        │                │                   │               ▼            │
│        │                │                   │          ┌─────────┐       │
│        │                │                   └─────────▶│ Closed  │       │
│        │                │                              └─────────┘       │
│        │                │                                   │            │
│        │                │                                   │            │
│        └────────────────┴───────────────────────────────────┘            │
│                              (Reopen)                                     │
│                                                                           │
└──────────────────────────────────────────────────────────────────────────┘

Case Statuses

Dispositions

When resolving or closing a case, analysts assign a disposition:

Quick Start

1. View Cases: Navigate to Cases in the sidebar
2. Create Case: Click New Case or press C
3. Assign: Assign to an analyst. A notebook is auto-created for the investigation
4. Investigate: Use the Investigation tab to search, add notes, and track entities
5. Resolve: Set disposition and close. An AI summary is generated with full case context

Keyboard Shortcuts

The case list and detail views are keyboard-navigable:

Documentation Sections

• Case Workflow - Detailed case lifecycle, status transitions, and investigation notebooks
• Auto-Grouping - Configure automatic alert grouping rules
• Entities - Entity extraction and the entity graph
• Audit Events & SOC Metrics - Build dashboards from case audit data
• Investigation Notebooks - AI-powered notebooks, @ commands, and case integration