diff --git a/unified-secops-platform/cases-overview.md b/unified-secops-platform/cases-overview.md index 3746ef606c..e7865321ed 100644 --- a/unified-secops-platform/cases-overview.md +++ b/unified-secops-platform/cases-overview.md @@ -81,7 +81,7 @@ Manage the following case details to describe, prioritize, assign, and track wor | Priority| `Very low`, `Low`, `Medium`, `High`, `Critical` | none | | Status | Set by analysts, customizable by admins | Default statuses are `New`, `Open`, and `Closed`
Default value is `New`| | Assigned to | A single user in the tenant | none | -| Description | Plain text | none | +| Description | Rich text | none | | Case details | Case ID | Case IDs start at 1000 and aren't purged. Use custom statuses and filters to archive cases. Case numbers are automatically set.| | | Created by
Created on
Last updated by
Last updated on | automatically set | | | Due on
Linked incidents | none | @@ -117,7 +117,7 @@ Each case has a threshold of 100 linked incidents. ### Activity log -Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case. +Need to write down notes, or that key detection logic to pass along? Create rich text comments and review the audit events in the activity log. Comments are a great place to quickly add information—including such things as queries, tables, links, and structured content—to a case. :::image type="content" source="media/cases-overview/informal-comments.png" alt-text="Screenshot showing informal comments between analysts.":::