Security incidents in cases

In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.

• Create a case from security incidents
  In Security Incident Response, you can create cases from security incidents. After the security incidents have been used to create a new case, you can use Security Case Management to analyze the data.
• Add security incidents to an existing case
  You can add security incidents to one or more existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.

Related concepts

• IoCs and observables in cases
• Configuration items in cases
• Affected users in cases