Creating a Case and Linking from Investigation Canvas

  • Rversion finale: Australia
  • Mis à jour 12 mars 2026
  • 1 minute de lecture

    • Use this section to create and link a case(s) from an investigation canvas.

    Avant de commencer

    Role required: sn_sec_tisc.analyst

    Procédure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select Threat Analyst Workbench icon.
    3. Go to Case Management > All Cases.
      This displays all the cases.
    4. Open any case record from the list.
    5. Select Link Case from the Details section.
      The Create and Link Case dialogue box appears.
    6. Select a case from the list to associate the case to an investigation canvas.
    7. Select Create New Canvas.
      The Create New Case dialogue box appears.
    8. Fill in the form fields, as appropriate.
      Field Description
      Case ID A unique identifier for the case. This is system generated ID.
      Short description Summary of the request or issue that is being investigated or a short description.
      Case Type Select the type of case being investigated. The possible options for the investigation are:
      • Threat Hunting
      • Request for Information
      • Vulnerability Management Case
      • Compliance Case
      • Incident Response Case
      • Collaboration Case
      • Others
      Priority Indicates the priority of a case.
      Assignment group The assigned group responsible for working on the case.
      Status The current status of the case.
      Assigned to The analyst who is responsible for working on a case.
    9. Select Create and Link to create a new case and link it directly to the investigation canvas.

      A confirmation is displayed confirming that the case is created and linked to the investigation canvas successfully.

      Remarque :
      This option is useful when no existing case is associated with the investigation canvas.
    10. To remove a linked case, select the Unlink button.
      For more information on how to directly link an existing case to the investigation canvas, see Linking an existing case from Investigation Canvas.