Case management
Track investigations from first alert to resolution with the SecureOPS case workflow.
Cases are how work gets organized in SecureOPS. Related alerts are grouped into a single case per incident, so your team investigates a story — not a stream of duplicates.
How cases are created
- Automatically — the AI SOC analyst groups alerts that share entities (host, user, source IP) and time proximity into one case.
- Manually — any analyst can create a case from search results, an alert, or from scratch.
Case lifecycle
| State | Meaning |
|---|---|
| New | Created, not yet reviewed by a human |
| Triaged | Severity and ownership confirmed |
| In progress | Under active investigation |
| Pending | Waiting on an external party or scheduled change |
| Resolved | Fix applied, monitoring for recurrence |
| Closed | Verified complete; case is immutable from here |
Working a case
Each case page contains:
- Timeline — every alert, comment, and action in chronological order.
- Entities — the hosts, users, IPs, and files involved, with pivot links to search.
- AI summary — the investigation summary and recommended actions, updated as new alerts join the case.
- Tasks — assignable checklist items with owners and due dates.
- Evidence — attached files, screenshots, and exported query results, hashed for integrity.
SLAs and escalation
Response and resolution SLAs are configured per severity under Settings → Case SLAs. When an SLA timer approaches breach, the case is highlighted and an escalation notification is sent to the configured channel (email, Teams, or webhook).
Reporting
Cases → Reports provides monthly and quarterly summaries: case volume by severity, mean time to triage, mean time to resolve, and top recurring detection types — ready to share with leadership or auditors.