- Case Manager Release Notes
- Get Started with Case Manager
- Configure Case Manager Settings
- Investigate a Security Incident
- Manually Create an Incident
- Edit an Incident
- Delete an Incident
- Manually Add an Entity
- Manually Add an Artifact
- Delete an Entity or Artifact
- Add Advanced Analytics Evidence to a Case Manager Incident
- Manage Tasks During an Investigation
- Send Messages from an Incident
- Filter Incidents
- Search for an Incident
- Sort Incidents
- Export Incidents
Notable Users Watchlist
On the HOME page, the Notable Users watchlist displays increasingly risky users that are potential threats.
If a user is involved in increasingly risky activities, they become a threat. Advanced Analytics marks them as a "notable user" once they cross a configured risk threshold. The default risk threshold is a risk score greater than or equal to 90 points. To modify this threshold, contact customer success.
When a user becomes notable, Case Manager creates an incident and lists it in the Notable Users watchlist.
If a user is associated with any open incidents, you see a folder 
and the number of open incidents. Click the folder to view the incidents and the priority, status, and assignee for each. To go to a specific incident, select the incident's name.
To filter notable users by when they became notable, select the time filter. When you select the folder for these filtered users, you see just the open incidents that were created within that time frame.
 |
To view all incidents in Case Manager, select the folder , then click View all incidents.