Summarize a Case with Now Assist for Threat Intelligence Security Center

Use Now Assist for Threat Intelligence Security Center to generate a concise summary of a case, including its key findings and recommended next steps.

Before you begin

Important:

Some Now Assist skills, agents, and agentic workflows are turned on by default. For more information, see Now Assist skills, agents, and agentic workflows on by default.

Role required: sn_sec_tisc.analyst

About this task

The Case Summarization skill analyzes the content of a threat case — including linked threat intelligence objects, notes, and activity history — and generates a concise summary. Analysts can review the summary and quickly understand the current state of the case.

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Select the Threat Analyst Workbench icon.
3. In Case Management, open the case you want to summarize.
   You can use case summarization for all case statuses, except Draft and Cancelled.
4. In the Details tab, select Summarize.
   You can also use the Summarize Case option from the Now Assist panel.

   Depending on the available data, the summary includes one or more of the following sections surfacing the prioritized details:

   • Case overview: Available for all summaries. Contains a brief overview and case details.
   • Findings: Contain details, such as, Key insights, Top risk indicators, Assets and Services.
   • Key actions taken: Lists the actions performed by analysts on the case.
   • Recommended next steps: Lists the possible case mitigation, subsequent procedures, or other next steps.
5. Optional: Select Share to open the summary in an editable window and add or remove summary details, and select Save to work notes.