Return excluded security artifacts to a case

After you have excluded artifacts from a list in a case, you can return them to the case you can continue to work on them.

Before you begin

The Threat Intelligence plugin must be activated to use Security Case Management.

Role required: sn_ti.case_user_write

Procedure

  1. Open a case that contains artifacts that you previous excluded from a list that you want to return to the list.
  2. Click the Case Artifacts related list.
  3. Click the tab associated with the artifacts you want to return to the list.
    Click the Excluded button to view items previously excluded from the list
  4. Click Excluded.
    The list of artifacts that were previously excluded are displayed.
    Excluded items
  5. Select the artifacts you want returned to the list.
  6. Click Include.
  7. Click Include in the confirmation box.
    The selected artifacts are removed from the list of excluded artifacts and returned to the list of artifacts included in the case.