---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Case Management

# Security Case Management {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Security Case Management

Security Case Management is designed for security analysts engaged in threat hunting to efficiently gather and analyze information about suspicious activities in their environment.
It allows you to create and manage security cases that consolidate related records such as security incidents, observables, configuration items (CIs), and affected users.
This consolidation supports thorough investigation and assessment of threats like targeted campaigns or advanced persistent threats.
Show full answer Show less  
Cases can be created from multiple sources within your ServiceNow instance, including Security Case Management, Security Incident Response, Threat Intelligence, Configuration Items, and Users tables. These sources can also enrich existing cases with additional relevant records.

## Key Features

* **Case Structure:** Each security case contains three core sections:
  * **Case Header:** Displays basic identification and classification details, including a case number with the SECC prefix.
  * **Additional Case Details:** Shows analysis-specific information such as case state, work notes, and recorded activities.
  * **Case Artifacts:** A collection of related records organized in tabs, enabling detailed investigation and argument-building for threat identification and response.
* **Interactive Artifact Management:** Analysts can search within artifact tabs, exclude records deemed safe or irrelevant (without deletion), and restore excluded records if necessary.
* **Additional Details and Annotations:** Within artifact tabs, clicking the Additional Details icon reveals related information (e.g., incidents or vulnerabilities linked to a specific CI). Analysts can also add personal annotations (notes) to individual artifacts to document insights or observations.
* **Analyst Tools:** Includes the ability to run sightings searches on observables and search for security artifacts to support investigation and case enrichment.

## Key Outcomes

With Security Case Management, ServiceNow customers gain a structured, comprehensive way to centralize and analyze security information, facilitating faster and more accurate threat detection and response. The ability to pivot through related records and annotate findings enhances collaboration and documentation. Excluding irrelevant data helps focus on critical evidence without loss of information, while integrated search capabilities streamline investigation workflows.  
Security Case Management provides a means for
security analysts who are engaged in threat hunting to gather information on suspicious activity
in their environment. Case-related records, such as security incidents, observables, CIs, and
affected users can be added to cases to accommodate broad and specific analysis.

With the ability to easily pivot through the records and related information, analysts can
assess whether they are facing a targeted campaign, advanced persistent threat, and so forth.

Security cases can be created from various sources on your instance, including Security Case Management, Security Incident Response, and Threat Intelligence. You can also create cases
from configuration items and affected users in the Configuration Items \[cmdb.ci\] and Users
\[sys.user\] tables, respectively. After cases have been created, each of these sources can be
also used to add valuable analysis resources to existing cases.

Each security case consists of three main sections, a header section, a section with additional
case details, and a case artifacts section containing a collection of records that aid in
building an argument for identifying and dealing with particular threats.

## Case header

Figure 1. Case header section

The case header provides basic information used to identify and classify the security case.
The case number uses the SECC prefix.

## Additional case details

Figure 2. Additional Case Details section

The Additional Case Details section provides information specific to
the analysis that has already been performed on the case, including its current state, and work
notes and activities recorded for the case.

## Case artifacts

Figure 3. Case Artifacts section

The Case Artifacts section provides a series of tabs of information
contained in the security case.

You can perform searches within the contents of each tab. You can also exclude specific
records you have already evaluated as being safe or which are of no value in your investigation.
The excluded records are not deleted, but are hidden from view. If needed, you can view excluded
records and add them back.  
Within each tab, you can click the Additional Details icon to show related information for the selected record. For example, if you click the Configuration Items tab to view the Configuration Items Explorer, and click Additional Details for a specific CI, you can view incidents, vulnerable items, and annotations associated with that CI. Figure 4. Case Artifacts---related detail  
You can also select a record and click the Annotate button for a case-related artifact to add annotations to the record. Annotations are simply notes that each analyst can make on a particular artifact. Figure 5. Security Annotations  
Other tools the analyst can use for examining cases include:

* [Run a sightings search on observables in a case](https://www.servicenow.com/docs/3F1_BeIXrFDWBT2x3HVGuQ "You can search for observables using the Sighting Search feature to determine how often they occur. Each occurrence is considered a sighting. You can limit the search to the number of sightings within a selected number of days or within a date range.")
* [Search for security artifacts](https://www.servicenow.com/docs/xy8cmfNqrb~mfpC5hj9Yhg "You can perform a keyword search on any security artifact list.")
{#case-mgmt__ul_djk_b3t_bz}