- Get Started with Threat Center
- Threat Center
- Threat Center Permissions
- Threat Center Alerts: Read
- Threat Center Alerts: Read, Write, and Delete
- Threat Center Cases: Read
- Threat Center Cases: Read, Write, and Delete
- Threat Center Detection Grouping Rules: Read
- Threat Center Detection Grouping Rules: Read, Write, and Delete
- Threat Center Watchlist: Read
- Threat Center Watchlist: Read, Write, and Delete
- Threat Center Cases
- Threat Center Alerts
- Threat Center Detections
- Threat Center Risk Score
- Monitor Entities of Interest in Threat Center
- Group Detections
- Work on Cases
- Work on Alerts
- Edit and Collaborate in Threat Center
- Use Automation Tools in Threat Center
- Find Cases and Alerts
- Sort Cases or Alerts
- Filter Cases or Alerts
- Search for Cases or Alerts in Threat Center
- Build a Search in Threat Center
- Enter a Search Using Exabeam Query Language in Threat Center
- Enter a Search Using Natural Language in Threat Center
- Run a Recent Search in Threat Center
- Create a New Saved Search in Threat Center
- Run a Saved Search in Threat Center
- Edit a Saved Search in Threat Center
- Delete a Saved Search in Threat Center
- View Case and Alert Metrics
- Get Notified About Threat Center
- Threat Center APIs
Manually Convert an Alert to a Case
Manually convert an alert to a case to start tracking your response to a threat and assign the case to the person responsible for responding.
When you convert an alert to a case, the case is associated with the alert; alert attributes and related detection attributes are copied to the case. To automatically convert an alert to a case under conditions you specify, create an Automation Management playbook.
To create a case that's not connected to an alert, manually create a case.
In an alert, click Convert to Case.
Enter information about the case:
(Optional) Stage – Select a case stage. If you select Closed, under Closed Reason, select the reason why you're closing the case:
Already mitigated/resolved – The threat has been addressed or resolved.
False positive or duplicate – The threat was mistakenly identified as a threat and is actually normal, non-malicious activity.
Low risk – The threat is insignificant or unlikely to harm the system or data.
Rule misconfiguration – Monitoring or detection content was misconfigured.
Policy or setup issue – The activity described in the case occurred because of known operations in your environment, like scheduled maintenance, authorized testing, or temporary workarounds.
Other – Enter a custom reason for why you're closing the case in the text box. You can enter up to 600 characters. To better communicate your message, you can also format the text.
(Optional) Queue – Assign the case to the case queue responsible for responding.
(Optional) Assignee – Assign the case to the person responsible for responding.
Priority – Select the case's priority: low, medium, high, or critical.
Click Convert. The case appears in the list under the Cases tab. When you select the associated alert, you are now automatically redirected to the case. This action is recorded in the case and alert history.