Case ManagerCase Manager Documentation

An entity is the primary object you are investigating. You may pivot on entities, and add or edit its information. There are three entity types: device, user, and file.Manually Add an Entity

While entities and artifacts are both objects, they are different when you look at them in context and the different roles they play in your investigation. An artifact is an object you collect when you investigate an incident, like evidence the police find when investigating a crime. An entity is the crime itself. An artifact enriches an entity.

An item can't be both an entity and an artifact. However, in specific cases, something might appear under both the Artifact and Entities sections in an incident. For example: a malicious file is an entity, but its contents are artifacts.