Case Management (CASE)

Case Management is the primary analyst workspace in the AI SOC 26.3.0 Core Solution. Ingestion creates records here with tracking prefix CASE-. Investigate from the Case Header, the sidebar, and the Case Investigation tab.

Open Case Management

Navigate to Application Records → Case Management.

Open a record from the list.

Record Layout

The record has three regions: a Case Header, a sidebar, and tabs. Case Investigation is the main investigation tab.

Case Header

The header shows the signal name, description, vendor logo (from Signal Source), and First Evidence (the Time of First Evidence field). Raw Alert opens the raw alert when that data is present.

Pills on the header read and write the case. Select a pill to change the value:

Pill	What it sets
Case Owner	Current Owner. Shows Unassigned while the case is still Processing and has no owner.
Classification	Writes Manual Classification. Options are Unknown, False Positive, True Positive, False Negative, and True Negative. Use AI Verdict restores Automated Classification.
Severity	Critical, High, Medium, Low, Informational, or Unknown. The pill appends Severity, so High reads High Severity.
AI Verdict	Blank while Status is Processing. After that, it shows the AI verdict. A manual choice writes Manual Verdict (Unknown, Benign, Suspicious, Malicious) and leaves the AI verdict stored. Use AI Verdict clears the override. The confidence ring stays hidden during Processing and while a manual verdict is set.
Priority	Shows Automated Priority until you pick a value. A pick writes Manual Priority (P0 through P4, or Unknown).
Status	Error, Processing, New, In Progress, Blocked, Escalated, or Closed. Resolved is not a Status value in this package.
Analysis Mode	Shows the stored value. On a current case the pill reads AI Assisted, Automated, or Agentic. Automated stays off the menu until Case Timeline contains Case Investigation Type Update - Automated. A case that still stores Manual displays Manual until you pick a current value. Investigation Type shows the same value.

Signal Type is Alert, Phishing Email, or Manual. Type is Signal or Incident. Intelligence Verdict (Malicious, Suspicious, Benign, Unknown) still comes from observable enrichment and appears in Threat Intelligence.

Sidebar

Widget	What you do
Incident Response SLA	Shows time used of the SLA window (for example 23:32:45 of 6h). The bar turns red when the case is past the window. Empty cases show No SLA Data Available. A new case uses Baseline. When Priority is P0, P1, P2, P3, or P4, the window uses that priority's hours. See Configure Custom Assets.
Investigation Type	Shows the same stored value as the header Analysis Mode pill. Choices are AI Assisted (analyst and AI collaboration), Automated (investigation playbook), and Agentic (Analysis agent). Automated stays off the menu until Case Timeline contains Case Investigation Type Update - Automated. A workflow can still show Automated on the control before that update. A stored value of Manual stays on the control until you select a current value.
Case Actions	When the case is unassigned, the buttons are Claim Case, Resolve Case, and Escalate Case. After you claim it, they are Unclaim Case, Resolve Case, and Escalate Case, and Owned by shows your user. Resolve Case is configured to set Status to Resolved. Resolved is not a Status value in this package. The middle button becomes Close Case. Close Case sets Closed. Escalate Case sets Escalated. Unclaim Case and Escalate Case stay visible after resolve.
Case Details	Owned by, Organization, First evidence observed, Case Created, and Last Updated. Only the owner row is editable.
Flags	Requires Attention and Post Incident Review. Turning on Post Incident Review asks you to confirm, because the PIR agent overwrites data in Lessons Learned.

An SLA breach notification goes to the current owner. After that notification succeeds, the playbook adds SLA Breached on Case Timeline and sets Requires Attention. The Incident Response SLA bar stays on the record.

SLA Target is the Date/Time when the SLA window ends. SLA Exceeded Notification runs at that time. When Status is Closed, SLA Target is cleared.

Case Correlation (Time Delay) runs when the Case Correlation Date/Time is reached. On a new case, Case Correlation defaults to the time the case is created, so the playbook runs one minute later. Results appear on Correlated Cases.

SLA Exceeded Notification and Case Correlation (Time Delay) run only when Date/Time Field Trigger is enabled. With that feature turned off, both stay idle and the record shows no error.

Sustained investigation stays on this record. Escalated may also be set by pending case resolution when your tenant rules apply (see Operations and Guidance).

Case Investigation Tab

Open Case Investigation. Widgets are stacked on the tab. The investigation plan, remediation plan, and automation each have their own widget.

Note: Correlated Cases, MITRE ATT&CK References, and Reporting are widgets on this tab. Lessons Learned, Manual Remediation, and Analyst Investigation are sections. Gaps between those widgets and sections can vary. That spacing is part of the record layout.

Widget	What you see and do
Case Summary	Opens partially expanded, with Affected assets and users and Details. Expand the card fully to show AI Verdict Analysis and Improvements.
Case Timeline	Lifecycle and activity, grouped as Case Milestone, Turbine Automation, Hero AI, User, and Other. Case Milestone uses a check mark.
Threat Intelligence	The summary shows Threat Intelligence Status, Turbine Risk Score, Intelligence Verdict, and Last Updated. Expand the card fully to show AI Analysis, Improvements, related threat intelligence records, and observables. Submit Observable adds an observable on this case.
Investigation	The header row is Type, Investigation Status, AI Verdict, and Confidence Score. Reanalyze sits next to the verdict. Before a plan exists, click Generate Investigation Plan. An AI Assisted plan is titled Recommended Investigation Plans. Phases are Preparation, Analysis, and Determination. Each phase has Step, Tool, Run All Steps, and Add Additional Step. An available tool shows Review and Run. A missing tool shows Install. Regenerate Investigation Plan rebuilds the plan. An Agentic run that has finished shows Investigation Status Complete and Agent Investigation marked COMPLETE. Re-investigate starts another agent run.
Remediation	Before a plan exists, click Generate Remediation Plan after investigation is complete. The plan is Recommended Remediation Plan, with Remediation Status and a step count. Phases are Containment, Eradication, and Recovery. Each phase has Step, Tool, Run All Steps, and Add Additional Step. A missing tool shows Install. An available tool shows Review and Run. Regenerate Remediation Plan rebuilds the plan.
Automation	Before a playbook exists: step 1 Create a Playbook (Ask Hero to help build a playbook) and step 2 Create a Triage Rule. After they exist, step 1 shows the playbook name and Recreate Playbook, and step 2 shows the rule name and Update Rule. Remove rule and playbook is at the top right of the widget. Notes under the steps say to update the knowledge base articles on the case, and that recovery-phase steps are excluded from automated playbook generation.
Correlated Cases	Columns are Correlation Status and Correlation Found. Correlation runs when the Case Correlation Date/Time is reached. A finished run can show Complete and Not Found. When cases match, they are listed under those columns.
MITRE ATT&CK References	Add or remove tactics and techniques. Each technique card lists D3FEND countermeasures. Select a name or ID to open it on the MITRE ATT&CK site. AI MITRE Analysis on Support runs AI MITRE ATT&CK D3FEND Analysis and stores the result in MITRE D3FEND Techniques JSON.
Reporting	Click Generate After Actions Report. The PDF is attached under After Actions Report, and you open it from the widget. The button stays available after a report exists.
Lessons Learned	Link to the Lessons Learned record for this case. That record has Main (Incident Review, with Engagement Summary, Incident Details, and Lessons Learned), References, PIR Metadata, and Audit. On Main, Title, Incident Summary, Investigative Intent, Investigative Findings, Positive Outcomes, and Improvements Needed display formatted markdown.
Manual Remediation	A collapsed section with three tabs. Observable Remediation has Block and Unblock. User Account Remediation has Block Account, Unblock Account, and Revoke Access Tokens. Host Remediation has Isolate Host and Release Host.
Analyst Investigation	Analyst Notes (Add a comment..., then Submit) and Evidence Locker (Drag + Drop or browse). An empty locker shows No Attachments.

AI Assisted investigation uses Generate Investigation Plan on the Investigation widget, then Run or Run All Steps. Progress detail messages stream until the plan is ready or you cancel.

Agentic investigation uses the Analysis agent. Set Analysis Mode to Agentic on the header pill or in Investigation Type. The header and Investigation Type both show Agentic. When the run finishes, Investigation Status is Complete and Agent Investigation shows COMPLETE. Review Reasoning for the verdict, confidence, Summary, Key Evidence, and Confidence Limitations. Click Re-investigate on Investigation to run again.

What the agent does:

Reads case details and threat intelligence already linked to the record.

Summarizes the alert (signal type, parties, observables, intelligence verdict).

Searches tenant components marked Visible to Hero AI.

Executes enrichment and analysis steps.

Writes a verdict, confidence, and recommended actions to the record.

Re-investigate starts a new run or runs again after evidence or knowledge base articles change. Confirm the dialog:

The agent will re-do the investigation.

Current progress and the associated data will be removed.

The case verdict will be reset to the initial verdict.

These changes cannot be reverted.

Update the linked Knowledge Base Articles before you confirm Re-investigate if you want the agent to follow new guidance.

Automation action	Purpose
Create a Triage Rule	Route similar signals automatically
Create a Playbook / Recreate Playbook	Convert the investigation into an investigation playbook for Signal Routing Rules
Build in Orchestration	Create or duplicate investigation playbooks and associate them on a rule. See Building Routing Rule Playbooks

Create a Playbook does not pull recovery steps from Generate Remediation Plan into the generated playbook, so automated containment is not immediately undone. Use reusable recovery playbooks after containment. See Getting Started and Troubleshooting.

Other Tabs

The tabs on the record are Case Investigation, Case Snapshot, Routing Rule, Knowledge Base, Metrics, Linked Cases, Audit, Support, and Manual Case Creation.

Case Snapshot: The Case Summary widget for this record.

Routing Rule: Which routing rules evaluated this record. Includes Rule Processed Reference, Rule Processing Status, Rule Matched, Rule Last Processed, and Playbook Run ID.

Knowledge Base: Linked knowledge base articles. Knowledge Base Article Search Status is Pending or Complete.

Metrics: Performance metrics, including MTTx and dwell.

Linked Cases: Parent and child relationships, with sync actions.

Audit: Who changed the record, and when.

Support: Manual actions, flow status, and stored investigation fields.

Manual Case Creation: The Create Case widget. Client names come from the AI SOC Clients List asset. See Configure Custom Assets.

Playbook Run ID can be blank when the default routing rule matches a case. The field is populated when an associated investigation playbook writes its current run ID (for example, $run.id). A blank value does not by itself mean rule processing failed. Review Rule Processing Status, Rule Matched, Rule Last Processed, and Rule Processed Reference.

Link Parent and Child Cases

Use the Linked Cases tab to represent related investigations as a parent-and-child hierarchy:

Parent Case references one parent Case Management record.

Child Cases references one or more child Case Management records.

After linking records, use the synchronization action that matches the direction you need:

Sync from Parent Case copies Classification, Manual Verdict, Status, and Current Owner from the selected parent to the current case.

Sync to Child Cases copies those fields from the current case to every selected child case.

Synchronization updates the selected fields; it does not merge all evidence or investigation data. Review the linked records before running an action because existing values in the destination cases are replaced.

Record Types and Lifecycle

Signal Type is Alert, Phishing Email, or Manual. Type is Signal or Incident.

New records often move from Processing to New, then progress through workflow states as they are claimed and resolved.

Automated CASE Lifecycle (Flows and Buttons)

After CASE records are created, several Flows and buttons automate evaluation and lifecycle:

Signal Routing Rules: Routing rules run associated playbooks when CASE records meet configured conditions. Test batch routing from a Routing Rule record using Run Rule Against Pending Signals on that rule's Support tab.

CASE Evaluation Automated: Applies default logic based on threat intelligence, correlation, and CASE fields.

Run Rules Engine: Re-evaluates routing rules for the current record (Support tab button; component AI SOC - Run Rules Engine against Current CASE Record).

Pending CASE Resolution / CASE Prioritization / Update CASE Metrics: Background Flows that set resolution outcomes, priority, and dashboard metrics once evaluation and rules have run.

Use these together to keep CASE triage, escalation, and reporting consistent across alert and phishing pipelines.

Processing Status

Processing means threat intel enrichment and evaluation (correlation, KB linking, Hero AI analysis) have not yet completed. When both complete, the pending resolution flow may set the record to New, Closed, or Escalated. Generate Investigation Plan is already on the Investigation widget. The AI Verdict pill stays blank until the record leaves Processing.

Threat Intelligence Status shows whether enrichments are pending or complete.

Rule Processing Status indicates whether routing rules have been evaluated.

Correlation Status shows if correlation is pending, processing, or complete. Case Correlation (Time Delay) runs when the Case Correlation Date/Time is reached. There is no manual correlation action on Support.

Correlation Timing

Case Correlation (Time Delay) runs when the Case Correlation Date/Time on the case is reached.

On a new case, Case Correlation defaults to the time the case is created. The playbook runs one minute after that time.

Results appear on Correlated Cases.

Support Tab

The Support tab is marked Read Only.

Case Execution Status is titled AI SOC Flow Execution Tracker. The rows are Case Correlation, Threat Intel Results, Routing Rule Engine, Hero AI Analysis, and Priority Setting. Each row shows a state such as Pending or Processing, plus a short reason (for example No status reported yet, Status: Processing, Waiting on correlation flow to complete, or Waiting on Threat Intel or Hero AI to complete).

Agentic Investigation Data:

Analysis Mode: The same value as the header pill. A current case shows AI Assisted, Automated, or Agentic.

Analysis Status: Not Started, In Progress, Completed, Failed, or Cancelled. A finished run shows Completed.

Component Runs: Attachments from agent component runs. An empty run shows No Attachments.

Analysis Agent Request ID and Analysis Agent Session: Track on-record Re-investigate runs and routing-rule analysis runs. Analysis Agent Session is stored as structured session data.

Previous AI Verdict, Previous AI Verdict Confidence, Previous AI Verdict Confidence Percentage, Previous AI Verdict Analysis, and Previous AI Threat Analysis: Prior AI output. Confidence and confidence percentage are separate fields.

MITRE Techniques Changed and Priority Calculation Running: Extra stored flags. Priority Calculation Running shows False when priority calculation is not running.

Manual Actions shows these buttons together:

AI Case Analysis: Run Hero AI analysis (for example, to refresh the verdict or summary).

Check Threat Intelligence Results: Refresh or open TI enrichment for observables.

Run Rules Engine: Re-run routing rule evaluation on this record.

Claim Case and Unclaim Case: Both buttons stay on Support. The sidebar Case Actions widget shows one of them, based on whether you own the case.

AI MITRE Analysis: Runs AI MITRE ATT&CK D3FEND Analysis for this case.

Other Support sections keep stored alert, phishing, correlation, and Hero AI fields for troubleshooting. Block, isolate, and account actions are on Case Investigation under Manual Remediation. Planning Agent / Rule Engine Data is still on the layout for plan, rule, and playbook run storage, and it includes HeroAI Generation Pending.

Configure widget permissions on Applications & Applets → Case Management → Form Layout. Select the widget, then Edit Widget. Each option can be limited to specific roles (use * to allow all roles).

Investigation uses generatePlan, modifyPlan, executePlan, useMarketplace, and changeInvestigationType. Remediation uses generatePlan, modifyPlan, executePlan, and useMarketplace. Automation and Case Actions use display to show or hide the widget. Investigation Type uses changeInvestigationType. See Getting Started — Permissions Configuration.

Where to Look First

Confirm Signal Source, Severity, and Classification on the Case Header.

Open Threat Intelligence and Correlated Cases on Case Investigation.

For AI Assisted, use Generate Investigation Plan on Investigation. For Agentic, set Analysis Mode to Agentic and click Re-investigate.

Detailed Workflow

Start with the Case Header and Case Details to confirm status, ownership, and severity.

Review Knowledge Base, Threat Intelligence, Correlated Cases, and Routing Rule. If a routing rule already ran AI SOC - Trigger Analysis Agent via Routing Rule, plan and verdict fields may already be populated.

Investigate using one path:

AI Assisted: On Investigation, use Generate Investigation Plan, run Preparation and Analysis steps, then generate a verdict in Determination.

Agentic: Set Analysis Mode to Agentic, click Re-investigate on Investigation, then review the agent results.

Automated: An investigation playbook already ran from a routing rule. Review the plan and verdict on the record.

Set AI Verdict (manual override) and Status on the header, or use Resolve Case in Case Actions. Use Regenerate Investigation Plan or Regenerate Remediation Plan when evidence or verdicts change.

If the pattern repeats, use Create a Triage Rule, Create a Playbook, or Recreate Playbook on the Automation widget.