Skip to content

Update cases-overview.md #254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

Update cases-overview.md #254

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
88e4959
Update cases-overview.md
amybook Apr 16, 2025
7cba248
Update unified-secops-platform/cases-overview.md
amybook Apr 28, 2025
f3262b5
Update cases-overview.md
amybook Apr 28, 2025
9337895
Merge branch 'public' into patch-1
amybook Apr 28, 2025
cb3675e
Merge branch 'public' into patch-1
amybook Apr 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions unified-secops-platform/cases-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ Manage the following case details to describe, prioritize, assign, and track wor
| Priority| `Very low`, `Low`, `Medium`, `High`, `Critical` | none |
| Status | Set by analysts, customizable by admins | Default statuses are `New`, `Open`, and `Closed`</br>Default value is `New`|
| Assigned to | A single user in the tenant | none |
| Description | Plain text | none |
| Description | Rich text | none |
| Case details | Case ID | Case IDs start at 1000 and aren't purged. Use custom statuses and filters to archive cases. Case numbers are automatically set.|
| | Created by</br>Created on</br>Last updated by</br>Last updated on | automatically set |
| | Due on</br>Linked incidents | none |
Expand Down Expand Up @@ -117,7 +117,7 @@ Each case has a threshold of 100 linked incidents.

### Activity log

Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case.
Need to write down notes, or that key detection logic to pass along? Create rich text comments and review the audit events in the activity log. Comments are a great place to quickly add information&mdash;including such things as queries, tables, links, and structured content&mdash;to a case.

:::image type="content" source="media/cases-overview/informal-comments.png" alt-text="Screenshot showing informal comments between analysts.":::

Expand Down