Case ManagerGet Started With Case Manager

Table of Contents

Get to Know an Incident

Break down an incident into its components, and learn about the information and functionality available in an incident.

On the INCIDENTS page, select an incident to view its information and take steps to review and manage it.

The elements of an incident highlighted in red and numbered with callout boxes.

1 Edit the incident; change its name, type, start and end time, restrict who can access the incident, and reassign the incident to a different priority, status, queue, or assignee.Edit an Incident

2 Delete the incident.Delete an Incident

3 Create an entity or artifact.Manually Add an EntityManually Add an EntityManually Add an ArtifactManually Add an Artifact

4 Reassign the incident to a different priority, status, queue, or assignee.Assign an Incident to a Queue, Assignee, Priority, or Status

5 Access the workbench to run actions and playbooks, and view the results.Manually Run an ActionManually Run a Playbook

6 View information about the incident. The fields vary based on the type of incident and from where it was ingested. You can customize these fields and how they're organized in the incident.Create a Custom Incident FieldCreate a Custom Incident FieldCustomize the Layout of an Incident TypeCustomize the Layout of an Incident Type

7 View entities associated with the incident and manually add add an entity.Manually Add an Entity

8 View the results of actions and playbooks you've run on the incident.

9 View the tasks that must be completed for this incident.Exabeam Tasks

10 View artifacts associated with the incident and manually add an artifact.Manually Add an ArtifactManually Add an Artifact

11 Send messages, like case notes and emails, directly from the incident.Send Messages from an Incident

12 View the incident's history.