Skip to main content

Case ManagerCase Manager Documentation

Version: i56

Edit a Custom Incident Filter

If you created a custom filter, edit the filter inputs to change how it's configured. You can't edit out-of-the-box filters.

  1. Next to the filter name, select the down arrow. The filter menu opens.

  2. Select a filter.

  3. Change the filter inputs:

    • Queue – Assign the incident to queue.

    • Assignee – Assign the incident to a person.

    • Date – Specify the dates the incident started, ended, was received, or closed.

    • Incident Type – Select a type that best matches the security scenario.

    • Status – Indicate the current state of your investigation.

    • Priority – Indicate how urgent the incident is.

    • Entity – Enter the name of an entity.

    • Artifact – Enter the name of an artifact.

    • Keyword – Search for a word or phrase. You can only search incident names, fields, entity fields, and artifact names. You can't search file content.

  4. Next to the filter name, click Save.