- Case Manager Release Notes
- Get Started with Case Manager
- Configure Case Manager Settings
- Investigate a Security Incident
- Manually Create an Incident
- Edit an Incident
- Delete an Incident
- Manually Add an Entity
- Manually Add an Artifact
- Delete an Entity or Artifact
- Add Advanced Analytics Evidence to a Case Manager Incident
- Manage Tasks During an Investigation
- Send Messages from an Incident
- Filter Incidents
- Search for an Incident
- Sort Incidents
- Export Incidents
Incident Email Communication
To collaborate with people who can't access Case Manager, send an email directly from an incident.
Email people who can't access Case Manager, like non-SOC staff in your organization, to exchange questions, instructions, and feedback about an investigation.
Case Manager transports emails using your organization's email servers. Your email server or service policies may restrict your email size or who you can send emails to.
Send an Email from an Incident
Send emails directly from an incident to communicate with people who can't access Case Manager.
Attach a File to an Incident Email
To add evidence to an incident, attach files to emails you send and receive directly in an incident. When you receive an attachment, safely preview it, view its details, and download it.
Your internal mailbox and email policies may limit and restrict what files you can attach, like how large or what file type they can be.
When you create an email, click INSERT ATTACHMENT. The attachment appears as an icon in the email body.
To send the email, click SEND. The attachment is added to the incident.
After 60 days, the attachment is purged, but the email text is not. To add the attachment to the incident indefinitely so you can run actions and playbooks on it, convert it into an artifact.
Convert an Email Attachment to an Artifact
When you receive an email attachment, convert it to an artifact to investigate it further.
In the incident, ensure the artifact doesn't already exist. You may duplicate an existing artifact you already created.
In the Messages tab, locate the email that contains the attachment.
On the attachment, click the More
menu, then select Add to Artifacts List.
Download an Email Attachment
Download an attachment you received in an incident email.
In an incident's Messages tab, find the email that contains the attachment.
On the attachment, click the More
menu, then select Download.