Skip to content

Commit d716b38

Browse files
Merge pull request #2781 from austinmccollum/patch-2
add thresholds cases-overview.md
2 parents 9bf0173 + 6f8436b commit d716b38

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

unified-secops-platform/cases-overview.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ To start using case management, select **Cases** in the Defender portal to acces
6565

6666
:::image type="content" source="media/cases-overview/cases-queue-view.png" alt-text="Screenshot of case queue.":::
6767

68+
The maximum allowed per tenant is 100,000 cases.
69+
6870
## Case details
6971

7072
Each case has a page which allows analysts to manage the case and displays important details.
@@ -112,6 +114,8 @@ Alternatively, if the IR team needs to escalate one or more incidents to the hun
112114

113115
:::image type="content" source="media/cases-overview/link-incident-from-incident-graph.png" alt-text="Screenshot showing the link incident option from ellipses menu in the incident view.":::
114116

117+
Each case has a threshold of 100 linked incidents.
118+
115119
### Activity log
116120

117121
Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case.

0 commit comments

Comments
 (0)