Work with cases

Alerts generate SIEM incidents. If an incident triggers an automated workflow (playbook), a SOAR-based case is automatically created. Each case represents one or more incidents that make up a potential attack. A case is a series of events on a timeline, where each event corresponds to an individual action within a playbook.

Using cases helps you and your team track and understand what happened through the course of an investigation and automated response.

Open and find cases

1. Open the Cases page using one of the following navigation paths:

   • Go to Investigation >> Cases.

   • In the SIEM navigation bar, go to Incidents Cases and click Cases.

2. Use the list to review your organization’s cases.

3. Sort the list by using the column titles (ascending or descending), including:

   • Owner

   • Severity

   • Status

   • Created date

   • Last Modified

4. Filter cases using the available filters, including:

   • Type

   • Owner

   • Severity

   • Status

   • Created

   • Last Modified

5. Use search to find specific cases:

   • Enter criteria in Search.

   • Use Created from and Created to to search by date.

6. (Optional) Click Reset View to clear sorting and filters.

Result: You can see a list of cases and narrow the list to the cases relevant to your investigation.

Work with the case timeline

1. Open a case.

2. Review the timeline of events on the left.

3. (Optional) For larger cases, scroll through the timeline.

4. (Optional) Find specific case events by using the search filters at the top of Event Details.

5. Click an event in the timeline.

6. Review the event’s details on the right.

Result: The selected event’s details are displayed, showing the playbook’s action data.

Change a case type

A case can be categorized as Threat or Risk (Threat is the default). Change the case type using the Status action block.

1. Click Playbooks in the navigation bar.

2. Find the playbook by filtering the list using Category or entering the Playbook Name.

3. Click the Status action block.

4. In Action, select Set Case Type.

5. In Type, select Threat or Risk.

6. Click Save Data.

Result: The case type is set to the selected value.

Assign or change a case owner

1. Open a case.

2. At the top of event details, use the owner field to select an owner from the drop-down.

3. To reassign, change the owner to a new one from the drop-down.

Result: A new event is added to the case detailing who the owner is or who the owner is changed to.

Add tags to a case

1. Open a case.

2. At the top of the case timeline, click + New Tag.

3. Enter the tag name.

4. Click Enter.

Result: The tag is added to the case.

Note: The case list contains case tags, but you can’t use the tags column to sort the list.

Add case comments

1. Open a case.

2. Go to the bottom of the case timeline.

3. Enter your comment.

4. Click Save.

Result: Your comment becomes part of the case timeline.

View case artifacts

1. Open the relevant case.

2. Select or click an event in the timeline.

3. Click Artifacts at the top.

4. (Optional) Use the Artifacts column headers to sort the artifacts in ascending or descending order.

Result: A list of artifacts for the selected case event is displayed.

Add an artifact manually

1. Open the relevant case.

2. Select or click an event in the timeline.

3. Click Artifacts at the top.

4. Next to the search field, click Add Artifact.

5. Select a type.

6. Add the relevant data and external reference or file.

7. Click Save.

Result: The artifact is added to the case event.

Add an artifact type

Add an artifact type that does not fall under the out-of-the-box artifact types.

1. Open a relevant case.

2. Click an event in the timeline.

3. Next to the search field, click Add Artifact.

4. In Add Artifact, go to Add New Artifact Type.

5. Enter the type’s name.

6. Click Add.

Result: The new type is added to the list.

Search trigger event data

Use trigger event logs to understand what triggered a playbook.

1. Open the Cases list:

   • Go to Investigation from the navigation bar and click Cases, or

   • Go to Incidents Cases and click Cases.

2. Search for the relevant case by applying filters or entering the case name.

3. In the case, click Trigger Event.

4. Click Query Incident Data.

Result: You are redirected to Logpoint Search.

Add search results to a case

1. Go to Investigation from the navigation bar and click Cases.

2. Click a case and click Trigger Event.

3. Click Query Incident Data (or Search, as shown in some documentation). You are redirected to Logpoint Search.

4. Enter a query/queries to drill down on the trigger event data.

5. Click Add Search To.

6. Click Case.

Result: The search results are added to the case.

Notes:

• If a search has no values in its results, you can’t add it to a case.

• Only 25 logs from a search can be saved to a case at a time.

Run a playbook from a case

When you run a playbook from the case or from an artifact, it is added as an event to the case.

1. Open a case.

2. At the top right, click Run Playbook.

3. In the playbook list, find the relevant playbook.

4. (Optional) Filter the list using Tags and Category/Categories.

5. Click Run.

6. Enter the relevant playbook parameters. Input parameters correspond to Logpoint SIEM based data. These parameters are the data SOAR will retrieve and use from SIEM.

7. Click Run Playbook.

Result: A new event is added to the case for the playbook run.

Respond to a prompt event

Respond to a playbook prompt action directly from a case timeline.

1. Go to the Cases list:

   • Go to Investigation from the navigation bar and click Cases, or

   • Go to Incidents Cases and click Cases.

2. Search for the case by applying filters or entering the case name.

3. Inside your case timeline, click Prompt.

4. In Prompt, type your response.

5. Click Continue and Yes.

6. Click Close.

Result: The playbook continues after the prompt is responded to.

Note: If you click Stop and No, the playbook stops.

Use graph overview

Graph overview provides a visual representation of the connections among multiple events, incidents, and artifacts within a case.

1. Open a case.

2. Open Graph Overview.

3. Arrange artifacts as needed.

4. To group artifacts, hold down Shift and click the artifacts you want to group.

Result: Artifacts are arranged and (optionally) grouped in graph overview.

Validation: After moving or arranging artifacts, refresh your session or log in again and confirm their positions stay the same.

Export a case as PDF

1. Open a case.

2. Click Generate PDF.

Result: The case details are exported in PDF.