Add a security incident to a security case

If you determine that a security incident requires a higher level of analysis, add it to a new or existing case.

Before you begin

The Threat Intelligence plugin must be activated to use Security Case Management.

Role required: sn_si.admin, sn_ti.case_user_write

Procedure

If it not already open, navigate to the security incident that requires escalation. For example, you can navigate to Security Incident > Incidents > Assigned to Me, and open the security incident.
Click the Add to Security Case related link.
The Add Security Incident(s) to Security Case dialog box opens.

If you have a case assigned to you that you want to add this security incident to, fill in the fields as appropriate, then click Submit.


Field	Description
Security Case	Select the security case.
Optional notes	As needed, enter additional notes that would be of value to the case analyst.

If you have one or more cases assigned to you, but want to create a new case and assign the security incident to it, click Create new case to show additional fields.

Note: If you do not have any cases assigned to you, the screen above opens first.

Fill in the fields as appropriate.


Field	Description
Security Case Name	Enter the name of the new security case.
Description	Enter a description for the case.
Case Type	Select the type of case being investigated.
Optional notes	As needed, enter additional notes that would be of value to the case analyst.

Click Submit.
A message appears at the top of the security incident, along with a link to the new case.