| 1 | --- |
| 2 | title: Incident cases |
| 3 | description: How to build and run an investigation case by linking multiple alerts, tracking work, and generating reports. |
| 4 | --- |
| 5 | |
| 6 | # Incident cases |
| 7 | |
| 8 | **Menu:** Incident Management → Cases |
| 9 | |
| 10 | Cases are where you **bundle related alerts into one investigation** (example: Wazuh + firewall + third‑party integration alerts) and track the work from triage → resolution. |
| 11 | |
| 12 | Deep link tip: you can open/highlight a case directly with: |
| 13 | |
| 14 | `/incident-management/cases?case_id=<id>` |
| 15 | |
| 16 |  |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## What you’re looking at |
| 21 | |
| 22 | The Cases view is split into two parts: |
| 23 | |
| 24 | - **Cases list** (left): your queue of open/in‑progress/closed cases |
| 25 | - **Case details** (right or modal): the selected case, with tabs like: |
| 26 | - **Overview** |
| 27 | - **Alerts** (linked alerts) |
| 28 | - **Comments** |
| 29 | - **Data Store** |
| 30 | |
| 31 | --- |
| 32 | |
| 33 | ## Step 1 — Create or open a case |
| 34 | |
| 35 |  |
| 36 | |
| 37 | 1) Open **Incident Management → Cases** |
| 38 | 2) Click a case in the list to open **details** |
| 39 | 3) Use **Overview** to confirm: |
| 40 | - case name + description |
| 41 | - customer (tenant) |
| 42 | - status + assignee |
| 43 | |
| 44 | --- |
| 45 | |
| 46 | ## Step 2 — Link multiple alerts to the same case |
| 47 | |
| 48 | A case becomes valuable when it holds *all the signals* for the incident. |
| 49 | |
| 50 | Example workflow: |
| 51 | - A **Wazuh** alert fires (endpoint) |
| 52 | - A **firewall** alert fires (network) |
| 53 | - A **third‑party integration** alert fires (cloud / email / EDR) |
| 54 | |
| 55 | Link them all to the same case so the case becomes the single place to: |
| 56 | - see the full timeline of signals |
| 57 | - coordinate comments |
| 58 | - generate a consolidated report |
| 59 | |
| 60 | ### UI callout: Review linked alerts |
| 61 | |
| 62 |  |
| 63 | |
| 64 | 1) Open the case details |
| 65 | 2) Click the **Alerts** tab |
| 66 | 3) Confirm all related alerts are listed under this case |
| 67 | |
| 68 | > Tip: You can link alerts from the **Alerts** screen as well (operators usually start from an alert, then attach it to an existing case). |
| 69 | |
| 70 | --- |
| 71 | |
| 72 | ## Step 3 — Use comments for investigation notes + handoff |
| 73 | |
| 74 |  |
| 75 | |
| 76 | 1) Open the case details |
| 77 | 2) Click **Comments** |
| 78 | 3) Add investigation notes, decisions, and handoff context |
| 79 | |
| 80 | --- |
| 81 | |
| 82 | ## Step 4 — Use Data Store for supporting material |
| 83 | |
| 84 |  |
| 85 | |
| 86 | Use **Data Store** to keep files tied to the case (exports, screenshots, timelines, supporting artifacts). |
| 87 | |
| 88 | --- |
| 89 | |
| 90 | ## Step 5 — Generate a case report (Jinja templates) |
| 91 | |
| 92 | Cases can generate reports using templates. |
| 93 | |
| 94 | ### UI callout: Generate Report |
| 95 | |
| 96 |  |
| 97 | |
| 98 | 1) Open the case details |
| 99 | 2) In **Overview**, click **Generate Report** |
| 100 | 3) Choose a **Template** |
| 101 | 4) Enter a **Filename** |
| 102 | 5) Click **Generate** |
| 103 | |
| 104 | Template notes: |
| 105 | - Templates are **customizable** and support **Jinja** templating. |
| 106 | - Different template types may generate different outputs (for example: a `.docx` template vs an `.html` template used to generate a PDF). |
| 107 | |
| 108 | --- |
| 109 | |
| 110 | ## Common gotchas |
| 111 | |
| 112 | ### “Why can’t I find all alerts for this incident in one place?” |
| 113 | Make sure you link each relevant alert (endpoint + network + third‑party) into the same case via the **Alerts** tab. |
| 114 | |
| 115 | ### “My report template isn’t available in the dropdown” |
| 116 | Report templates are managed in the template manager (your environment may restrict who can upload/manage templates). |