All versions of this manual

Alerts: Investigating cases

Case Investigation

You can investigate a case by clicking on the case's id in the case list or the unified case list. It opens a dedicated interface where you can:

  • See a visualization of the case
  • Leave comments on the case (visible to other investigators)
  • Go back to the case list
  • Change the status of the case (e.g. Confirm the case)

Some features such as expanding nodes, hiding items, filtering and grouping are available to help in the investigation. Clicking on a node or edge opens the property panel that displays its type and properties. You can also download an image of the case, use the geo mode, and undo or redo the last action.

You can save the current state of the investigation by clicking on the "Save" button that appears after you update the visualization (e.g. by adding a node).

You can add comments on a case and share more information with collaborators.

You can change the status of the case (from the top-right of the page). screenshot: changing the status of a case

When changing the status to either In progress, Confirmed or Dismissed, you will be prompted for an optional note, to document the decision for future reference. screenshot: adding a note when confirming a case

You can assign the case to someone directly through the information panel. To do so, you just need to click on "Assign" button next to the assignee username. You will find the history of assignement in the activity panel, with comments and status changes.