Create a case

Create a case for a security investigation.

Note

To create a case manually, you must have View/Edit permission for Cases and Issues selected under Settings → Configurations → Access Management → Roles → Components → Cases & Issues.

You can create a case directly from the Cases page.

1. On the Cases page click New Case.
2. Under Case Details, specify the name, severity, and (Optional) description.

   The severity of a manually generated case cannot be low.
3. Under Issue Details, select the issues to link to the case, or create a new issue.

   Tip

   The issues that you link to a case can be linked to multiple cases, and the issue domains do not need to match the case domain.
4. Under Issue Fields, define the following:

   Note

   This option is only relevant for certain domains.

   • MITRE ATT&CK tactics and techniques to assign to the case.
   • Custom issue fields.
5. (Optional) Under Playbook, specify playbook run settings. By default, a playbook is run Automatically by trigger.

   Note

   This option is only relevant for certain domains.
6. Click Create new case.

   Each case creation generates one issue. The name, the severity, and the description of the generated issue mirrors the name, the severity, and the description of the case.

   Note

   You can't attach files to manually created cases.

After case creation you can link and unlink issues from the case, as required. For more information, see Link or unlink issues from a case.