SOC Cases: Tag alerts with Case ID

[btdewey]

Problem: When escalating an aggregation there is no way to tie a specific alert to an escalation short of using the open and close time stamps. When going back to review a closed escalation it's difficult to see exactly what alerts were investigated.

Solution: When acknowledging or escalating alerts a new field is inserted with an acknowledge/escalated status into the record (from what I'm seeing). Inserting the case ID into the acknowledgement would be fairly simple to add at that point. Please insert a case ID into the alert when escalating so it's possible to tie individual alerts to a case. This also would also simplify the aggregation query in cases. The aggregation query could simply be to look for the case ID.