IoCs and observables in cases

In Threat Intelligence, you can create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You can also create observables directly from a case.

• Create a case from IoCs or observables
  In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.
• Add IoCs and observables to an existing case
  You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.
• Create an observable from a case
  New observables can be created from cases in Security Case Management.
• Run a sightings search on observables in a case
  You can search for observables using the Sighting Search feature to determine how often they occur. Each occurrence is considered a sighting. You can limit the search to the number of sightings within a selected number of days or within a date range.

Related concepts

• Security incidents in cases
• Configuration items in cases
• Affected users in cases