| 1 | # Incident Management |
| 2 | |
| 3 | **Menu:** Incident Management |
| 4 | |
| 5 | **Best for:** SOC operators / analysts |
| 6 | |
| 7 | Incident Management is where analysts spend most of their time. |
| 8 | |
| 9 | ## Sub-pages |
| 10 | |
| 11 | - **Sources**: define/organize alert sources |
| 12 | - **Alerts**: triage queue |
| 13 | - **Cases**: investigation lifecycle |
| 14 | - **Case Templates**: reusable investigation playbooks (admin / analyst) — see [Case templates](incident-case-templates.md) |
| 15 | |
| 16 |  |