Skip to content

Commit 1fb40ba

Browse files
add thresholds cases-overview.md
1 parent 033f82f commit 1fb40ba

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

unified-secops-platform/cases-overview.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ To start using case management, select **Cases** in the Defender portal to acces
6565

6666
:::image type="content" source="media/cases-overview/cases-queue-view.png" alt-text="Screenshot of case queue.":::
6767

68+
The maximum allowed per tenant is 100,000 cases.
69+
6870
## Case details
6971

7072
Each case has a page which allows analysts to manage the case and displays important details.
@@ -112,6 +114,8 @@ Alternatively, if the IR team needs to escalate one or more incidents to the hun
112114

113115
:::image type="content" source="media/cases-overview/link-incident-from-incident-graph.png" alt-text="Screenshot showing the link incident option from ellipses menu in the incident view.":::
114116

117+
The threshold for linking is 100 incidents per case.
118+
115119
### Activity log
116120

117121
Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case.

0 commit comments

Comments
 (0)