---
title: Case Management (CASE)
slug: solutions/case-management-case
docTags: 
createdAt: 2026-03-04T10:35:52.524Z
---

**Case Management** is the primary analyst workspace in current AI SOC packages. Ingestion creates records here with tracking prefix **CASE-**. Use **Case Analysis** and related tabs for triage, Hero AI, evidence, and lifecycle actions.

## Open Case Management

1. Navigate to **Application Records** → **Case Management**.
2. Open a record from the list.

## Case Analysis Tab

The **Case Analysis** tab is the main workspace for investigating each alert or case. From here you identify the record, run quick actions, and review key fields in one place.

### Identification and Quick Actions

At the top of the record you can:

- **Claim**: Assign the record to yourself as the current owner. Use this when you are ready to start investigating. Claiming also sets the time-assigned timestamp for tracking.
- **Unclaim**: Un-assign the case so another analyst can claim it (orchestration action **Unclaim Case**).

Sustained investigation uses this **Case Management** record: **Status** (for example **In Progress**), investigation comments, evidence, and routing rules. **Escalated** may be set when **pending CASE resolution** and your tenant rules apply (see [Operations and Guidance](<././Operations and Guidance.md>)).

You will also see the **Tracking Id** (for example, **CASE-21**) with an option to copy the link, **timestamps** for when the record was created and last updated (and by whom), and **SLA status** when SLA is configured (for example, how much SLA time has been used, with visual indication as you approach the limit).

### Key Fields on the Record

The record shows essential information about origin and current state:

- **Time of First Evidence**: When the first piece of evidence was collected. Helps you understand the investigation timeline.
- **First Created / Last Updated**: When the record was created and last modified. Useful for tracking how long it has been in the queue.
- **Current Owner**: Who is responsible for investigating this record. Empty means unassigned.
- **Organization**: Which organizational unit owns this record. Helps with multi-tenant environments.
- **Signal Type**: Whether the case represents an Alert, Phishing email, or Triage record. Different types may have different workflows.
- **Signal Source**: Which system generated the alert (for example, Splunk, CrowdStrike, Email Gateway). Helps you understand the alert origin and reliability.
- **Intelligence Verdict**: The aggregated threat intelligence verdict (Malicious, Suspicious, Benign, Unknown) based on observable enrichment. Calculated from your TI providers and gives you an immediate risk assessment.

### Status and Classification Fields

These fields help you classify and prioritize:

- **Manual Verdict**: Your final assessment after investigation (Malicious, Suspicious, Benign, Unknown). The AI verdict is a recommendation; your manual verdict is the authoritative decision.
- **Status**: Current workflow state (Processing, New, In Progress, Blocked, Escalated, Closed). Use this to track where the record is in your investigation process.
- **Priority**: Urgency level (P0–P4). P0 is most urgent. Set this based on severity and business impact.
- **Severity**: Technical severity (Critical, High, Medium, Low, Informational, Unknown). Reflects the technical risk level of the threat.
- **Classification**: Final disposition (True Positive, False Positive, Unknown). Use this to track whether the alert was valid and to improve future detection.

If your layout uses a **linked** record for part of the workflow, some fields on this record may be read-only; edit **Manual Verdict**, **Status**, **Priority**, **Severity**, and **Classification** where your form allows, or on the linked record when that is how your organization configured the application.

### AI Analysis Widget (AI Alert Analysis)

The **AI Analysis** widget on the layout drives the **AI Alert Analysis** experience on the record—AI-powered analysis and investigation guidance.

| **Section**             | **What you see**                                                                                                                                                        | **Common actions**                                                                                                                                         |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Signal Summary**      | Signal Name, Investigation Summary, Confidence Score, AI Verdict, Verdict Analysis, Threat Intelligence Analysis, MITRE Analysis                                        | **Reanalyze** (Manual) or **Re-investigate** (Autonomous); **Generate Remediation Plan**; **Regenerate Remediation Plan** (when a plan exists)             |
| **Agent Investigation** | Analysis agent reasoning narrative, step completion indicators, and status badge (**Not Started**, **In Progress**, **Complete**, **Failed**, **Cancelled**)            | Visible when **Analysis Mode** is **Autonomous**; expand step groups to see component runs                                                                 |
| **Investigation Plan**  | Preparation, Analysis, and Determination stages                                                                                                                         | **Generate Plan** or **Generate Investigation Plan**, **Regenerate Investigation Plan**, **Review**, **Run**, **Run All Steps**, **+ Add Additional Step** |
| **Automation**          | Triage rules and playbooks from the current case; **Playbook Run Details** when a routing playbook has run and no investigation plan exists yet (typical for N+1 cases) | **Create a Triage Rule**, **Create a Playbook**, **Recreate Playbook**; expand steps in **Playbook Run Details** to review collected execution data        |

During **Generate Plan** or **Regenerate Investigation Plan**, **progress detail** messages stream in the panel until the plan is ready or you cancel.

**Agentic investigation (Autonomous mode)**

When **Analysis Mode** is **Autonomous**, the **Analysis agent** investigates without an analyst running plan steps. Set **Analysis Mode** on the case metadata column (**Case Analysis**) or on **Support** (under **Agentic Investigation Data**), then click **Re-investigate** in the **Signal Summary** area of **AI Alert Analysis**.

**What the agent does:**

1. Reads case details and threat intelligence already linked to the record.
2. Summarizes the alert (signal type, parties, observables, intelligence verdict).
3. Searches tenant components marked **Visible to Hero AI** (for example, URL analysis, email enrichment, IP reputation).
4. Executes enrichment and analysis steps; each group shows how many steps completed.
5. Compiles a verdict with confidence, key evidence, and recommended actions; results are written to the record.

**Agent Investigation panel:** Below **Signal Summary**, the **Agent Investigation** section streams the agent's reasoning. While a run is active, the status badge shows **In Progress**. When the run finishes, the badge shows **Complete** (or **Failed** / **Cancelled**). Before the first run starts, the badge shows **Not Started** and the panel may show that no reasoning details are available yet.

**After investigation:** Review **Investigation Summary**, confidence, and verdict in **Signal Summary**. Use **Verdict Analysis**, **Threat Intelligence Analysis**, and **MITRE Analysis** for deeper views. Use **Generate Remediation Plan** and **Automation** (**Create a Triage Rule**, **Create a Playbook**) when you are ready to operationalize the pattern.

**Re-investigate**

Click **Re-investigate** in **Signal Summary** to start a new autonomous run or run again after evidence or KBAs change. A confirmation dialog appears:

- The agent will re-do the investigation.
- All current progress and the associated data will be removed.
- Case verdict will be reset to the initial verdict.
- These changes cannot be reverted.

:::hint{type="info"}
To give the agent new guidelines before a re-run, update the linked **Knowledge Base Articles** first, then click **Re-investigate** and confirm.
:::

**Agentic investigation on the record:** Open the record, set **Analysis Mode** to **Autonomous**, then click **Re-investigate** in **AI Alert Analysis**. Monitor the **Agent Investigation** panel. Component inputs, outputs, and attachments are stored on the record.

| **Automation action**                         | **Purpose**                                                                                                                                                                           |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create a Triage Rule**                      | Route similar signals automatically                                                                                                                                                   |
| **Create a Playbook** / **Recreate Playbook** | Convert the investigation into an **investigation playbook** for **Signal Routing Rules**                                                                                             |
| Build in **Orchestration**                    | Create or duplicate **investigation playbooks** and associate them on a rule — see [Building Routing Rule Playbooks](<../Operations and Guidance/Building Routing Rule Playbooks.md>) |

:::hint{type="info"}
**Create a Playbook** does **not** pull **recovery** steps from **Generate Remediation Plan** into the generated playbook (by design), so automated containment is not immediately undone. Use **reusable recovery playbooks** or your standard process after containment. See [Getting Started](<././Getting Started.md>) and [Troubleshooting](././Troubleshooting.md).
:::

The AI uses threat intelligence, knowledge base articles, and historical patterns to generate relevant investigation steps. You can modify the plan, add steps, remove steps, or run steps in any order.

### Evidence Areas

- **Knowledge Base Articles**: Linked articles that match observable patterns or alert characteristics.
- **Threat Intelligence**: Enrichment results for observables extracted from the record. If **Add Observable** receives an invalid observable, the notification includes the Case Management tracking ID. Select the notification to open that case, then expand its Threat Intelligence area to review the failure.
- **Correlation**: Related records that may be part of the same incident.
- **Rules**: Which routing rules processed this record and what actions were taken.
- **MITRE ATT\&CK References**: Mapped tactics and techniques. Select a tactic or technique name or ID to open its page on the MITRE ATT\&CK website.

### Other Tabs

- **Routing Rule**: Which routing rules evaluated this record and their results. The tab includes **Rule Processed Reference**, **Rule Processing Status**, **Rule Matched**, **Rule Last Processed**, and **Playbook Run ID**.
- **Knowledge Base**: Quick access to linked KB articles without leaving the record.
- **Metrics**: Performance metrics and summaries.
- **Timeline**: Milestones in the lifecycle (for example, threat intel returned, correlation completed, priority set, resolution). Informational; clicking a milestone does not trigger an action.
- **Linked Cases**: Parent and child case relationships, with actions to synchronize selected fields between linked records.
- **Audit**: Change history showing who did what and when.
- **Support**: Manual actions and troubleshooting tools.

:::hint{type="info"}
**Playbook Run ID for the default routing rule:** **Playbook Run ID** can be blank when the default routing rule matches a case. This field is populated when an associated investigation playbook writes its current run ID to the case (for example, with `$run.id`). A blank value for the default rule does not by itself indicate that rule processing failed; review **Rule Processing Status**, **Rule Matched**, **Rule Last Processed**, and **Rule Processed Reference** for the routing result.
:::

## Link Parent and Child Cases

Use the **Linked Cases** tab to represent related investigations as a parent-and-child hierarchy:

- **Parent Case** references one parent Case Management record.
- **Child Cases** references one or more child Case Management records.

After linking records, use the synchronization action that matches the direction you need:

- **Sync from Parent Case** copies **Classification**, **Manual Verdict**, **Status**, and **Current Owner** from the selected parent to the current case.
- **Sync to Child Cases** copies those fields from the current case to every selected child case.

Synchronization updates the selected fields; it does not merge all evidence or investigation data. Review the linked records before running an action because existing values in the destination cases are replaced.

## Record Types and Lifecycle

- **Signal Type** can be Alert, Phishing, or **Triage**.
- New records often move from **Processing** to **New**, then progress through workflow states as they are claimed and resolved.

### Automated CASE Lifecycle (Flows and Buttons)

After CASE records are created, several Flows and buttons automate evaluation and lifecycle:

- **Signal Routing Rules:** Routing rules run associated playbooks when CASE records meet configured conditions. Test batch routing from a **Routing Rule** record using **Run Rule Against Pending Signals** on that rule's **Support** tab.
- **CASE Evaluation Automated:** Applies default logic based on threat intelligence, correlation, and CASE fields.
- **Run Rules Engine:** Re-evaluates routing rules for the current record (**Support** tab button; component **AI SOC - Run Rules Engine against Current CASE Record**).
- **Pending CASE Resolution / CASE Prioritization / Update CASE Metrics:** Background Flows that set resolution outcomes, priority, and dashboard metrics once evaluation and rules have run.

Use these together to keep CASE triage, escalation, and reporting consistent across alert and phishing pipelines.

## Processing Status

- **Processing** means threat intel enrichment and evaluation (correlation, KB linking, Hero AI analysis) have not yet completed. When both complete, the pending resolution flow may set the record to **New**, **Closed**, or **Escalated**. Do not expect **Generate Plan** or an AI verdict until the record has left **Processing**.
- **Threat Intelligence Status** shows whether enrichments are pending or complete.
- **Rule Processing Status** indicates whether routing rules have been evaluated.
- **Correlation Status** shows if correlation is pending, processing, or complete; correlation runs on a schedule through **AI SOC - Main** (there is no manual correlation action on **Support**).

## Correlation Timing

- **Correlation** runs on a schedule (every 10 minutes by default) and evaluates older records in batches.
- Records are typically eligible for correlation after a short delay (about 5 minutes) so ingestion and enrichment can complete first.
- Each run evaluates the oldest eligible records in a batch (up to 100 at a time) to avoid reprocessing newer records.

## Support Tab

**Agentic Investigation Data** (expand on **Support**):

- **Analysis Mode**: **Manual** (**AI assisted investigation** with **Generate Plan**) or **Autonomous** (agentic investigation via **Re-investigate** in **AI Alert Analysis**). The field appears in the case metadata column on **Case Analysis** and under **Agentic Investigation Data** on **Support**.
- **Analysis Status**: **Not Started**, **In Progress**, **Completed**, **Failed**, or **Cancelled** for **AI SOC - Trigger Analysis Agent** runs.
- **Component Runs**: File attachments from agent component runs during autonomous investigation.
- **Analysis Agent Request ID** and **Analysis Agent Session**: Track on-record **Re-investigate** runs and routing-rule analysis runs.
- **Previous AI Verdict**, **Previous AI Verdict Confidence**, and **Previous AI Verdict Analysis**: Prior AI verdict captured before **Re-investigate** resets the case verdict.

**Manual Actions** (expand **Manual Actions** on **Support**):

- **AI Case Analysis**: Run Hero AI analysis (for example, to refresh verdict or summary).
- **Check Threat Intelligence Results**: Refresh or open TI enrichment for observables.
- **Run Rules Engine**: Re-run routing rule evaluation on this record.
- **Claim Case**: Assign ownership when starting investigation.
- **Unclaim Case**: Un-assign ownership.

**Other Support tab options:**

- **Read Only**: Prevents accidental edits while reviewing.
- Visibility toggles for sections such as **Signal Data**, **Case Metadata**, **Hero AI Features**, **Alert Data**, and **Phishing Email Data**.

## AI Alert Analysis Configuration (RBAC)

Configure role-based options on **Applications & Applets** → **Case Management** → **Form Layout** → **Case Analysis** tab → select the **AI Analysis** widget → **Edit Widget**. Each option can be enabled or disabled and limited to specific roles (use \* to allow all roles).

- Summary section, Plan section, Remediation section, Automation section
- **Generate Plan**, Modify Plan, Execute Plan, Marketplace components
- Remediation without malicious verdict (optional)

## Where to Look First

- Confirm **Signal Source**, **Severity**, and **Classification**.
- Validate **Intelligence Verdict** and **Observables**.
- Use **Generate Plan** (manual mode) or **Re-investigate** in **AI Alert Analysis** (when **Analysis Mode** is **Autonomous** on **Support**) to start investigation.

## Detailed Workflow

1. Start with metadata and triage fields to confirm status, ownership, and severity.
2. **Review** evidence areas in order: **Knowledge Base** → **Threat Intelligence** → **Correlation** → **Rules**. If a routing rule already ran **AI SOC - Trigger Analysis Agent via Routing Rule**, plan and verdict fields may already be populated.
3. Investigate using one path:
   - **AI assisted investigation:** Use **Generate Plan**, run Preparation and Analysis steps, then generate a verdict in Determination.
   - **Agentic investigation on the record:** Set **Analysis Mode** to **Autonomous** on **Support**, click **Re-investigate** in **AI Alert Analysis**, then review results in the **Agent Investigation** panel.
   - **Review after routing:** A **Signal Routing Rule** already ran agentic investigation—review plan and verdict on the record.
4. Set **Manual Verdict** and **Status** per your process (**Escalated** may be set by automated pending resolution when configured). Use **Regenerate Investigation Plan** or **Regenerate Remediation Plan** when evidence or verdicts change.
5. If the pattern repeats, use **Create a Triage Rule**, **Create a Playbook**, or **Recreate Playbook** in Automation.