Add events to cases

To create a new case from an event, do as follows:

1. At the top right of an event details page, click Actions > Create New Case.
2. Give the investigation a title and select a Priority and Case Type.
3. Specify the Key Findings Template as blank or Security Investigation.
4. (Optional) Add custom tags to the case.
5. Click Submit.

To add multiple events to a case, do as follows:

1. From a table of events, use the checkboxes to select multiple events.
2. In the upper right of the table, click Actions > Create New Case.
3. Give the investigation a title and select a Priority and Case Type.
4. Specify the Key Findings Template as blank or Security Investigation.
5. (Optional) Add custom tags to the case.
6. Click Submit.

To add an event to an existing case, do as follows:

1. At the top right of an event details page, click Actions > Add to Existing Case.
2. Search by the title to find the existing case.
3. Click Submit.

To add multiple events to an existing case, do as follows:

1. From a table of events, use the checkboxes to select multiple events.
2. In the upper right of the table, click Actions > Add to Existing Case.
3. Search by the title to find the existing case.
4. Click Submit.