Skip to content

Latest commit

 

History

History
234 lines (186 loc) · 10.3 KB

OPEN_CASES_USER_GUIDE.md

File metadata and controls

234 lines (186 loc) · 10.3 KB

Open Cases Dashboard User Guide

Overview

The Open Cases Dashboard provides SOC analysts with a centralized view of all Security Hub findings currently being reviewed by team members. This feature helps prevent duplicate work, provides visibility into analyst workload, and enables efficient case management.

Accessing Open Cases

Navigation

  1. From Main Dashboard: Click the "Open Cases" button in the header of the main findings dashboard
  2. Direct URL: Navigate to /open-cases in the application
  3. Browser Bookmark: Bookmark the Open Cases page for quick access

Authentication

  • Requires the same authentication as the main application
  • Uses your existing ENTRA (Azure AD) session
  • No additional login required

Open Cases Interface

Dashboard Layout

The Open Cases dashboard follows the same professional AWS Console-style design as the main findings dashboard:

┌─────────────────────────────────────────────────────────────┐
│ Header: "Open Cases" | Refresh Button | Back to Findings    │
├─────────────────────────────────────────────────────────────┤
│ Summary Stats: Total Open Cases | Active Analysts           │
├─────────────────────────────────────────────────────────────┤
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Open Cases Table                                        │ │
│ │ ┌─────────┬──────────┬─────────┬──────────┬──────────┐ │ │
│ │ │ Finding │ Severity │ Analyst │ Duration │ Actions  │ │ │
│ │ ├─────────┼──────────┼─────────┼──────────┼──────────┤ │ │
│ │ │ S3.13   │ HIGH     │ analyst │ 02:15:30 │ View     │ │ │
│ │ │ EC2.1   │ CRITICAL │ analyst │ 01:45:12 │ View     │ │ │
│ │ └─────────┴──────────┴─────────┴──────────┴──────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘

Key Information Displayed

Finding Information

  • Finding Title: Brief description of the security issue
  • Finding ID: Truncated Security Hub finding identifier
  • Severity: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL
  • Compliance Status: FAILED, WARNING, PASSED, NOT_AVAILABLE
  • Resource: Primary AWS resource affected

Session Information

  • Analyst Email: Email of the analyst currently reviewing the finding
  • Session Duration: Real-time calculation of how long the session has been active
  • Opened At: Timestamp when the analyst started reviewing the finding

Visual Indicators

  • Severity Badges: Color-coded severity indicators
    • 🔴 CRITICAL (Red)
    • 🟠 HIGH (Orange)
    • 🟡 MEDIUM (Yellow)
    • 🟢 LOW (Green)
    • 🔵 INFORMATIONAL (Blue)
  • Active Session Indicator: Red email text indicates active review session

Features and Functionality

Real-time Updates

  • Auto-refresh: Page automatically refreshes every 60 seconds
  • Manual Refresh: Click the refresh button for immediate updates
  • Session Duration: Live calculation of session time
  • Status Changes: Reflects when findings are resolved or sessions end

Navigation and Actions

  • View Finding Details: Click on any finding to navigate to the detailed view
  • Back to Main Dashboard: Return to the main findings dashboard
  • Direct Links: All finding links work with complete ARN support

Session Management

  • Active Sessions Only: Shows only findings currently being reviewed
  • No Duplicate Work: Prevents multiple analysts from working on the same finding
  • Audit Trail: Complete tracking of who opened and is working on each case

Use Cases and Workflows

Daily SOC Operations

Morning Briefing

  1. Check Open Cases: Review what cases are currently being worked on
  2. Workload Assessment: See which analysts are active and their case load
  3. Priority Review: Identify high-severity cases that need attention

Case Assignment

  1. Avoid Duplicates: Check if a finding is already being reviewed before starting
  2. Load Balancing: Distribute work based on current analyst activity
  3. Handoff Management: Coordinate case transfers between shifts

Supervisor Oversight

  1. Team Activity: Monitor analyst productivity and case resolution times
  2. Bottleneck Identification: Identify cases that have been open too long
  3. Resource Allocation: Adjust team assignments based on workload

Workflow Examples

Scenario 1: Starting a New Investigation

1. Analyst opens main findings dashboard
2. Identifies a CRITICAL finding to investigate
3. Checks Open Cases to ensure no one else is working on it
4. Clicks on finding to start investigation (auto-starts session)
5. Finding appears in Open Cases for other analysts to see

Scenario 2: Shift Handoff

1. Outgoing analyst reviews their open cases
2. Documents progress in finding details
3. Resolves completed cases (auto-ends sessions)
4. Incoming analyst checks Open Cases for ongoing work
5. Continues investigation on handed-off cases

Scenario 3: Supervisor Review

1. Supervisor opens Open Cases dashboard
2. Reviews session durations to identify long-running cases
3. Checks analyst workload distribution
4. Reassigns cases or provides additional resources as needed

Data and Analytics

Session Metrics

  • Duration Tracking: Real-time calculation of session length
  • Analyst Activity: Visual representation of who is working on what
  • Case Load: Number of active cases per analyst
  • Resolution Patterns: Historical data on case completion times

Performance Indicators

  • Average Session Duration: Typical time to resolve findings by severity
  • Analyst Efficiency: Cases resolved per analyst per time period
  • Workload Distribution: Even distribution of cases across team members
  • Priority Handling: Response time for CRITICAL and HIGH severity findings

Integration with Main Dashboard

Seamless Navigation

  • Consistent Design: Same AWS Console-style interface
  • Shared Authentication: Single sign-on across all pages
  • Real-time Sync: Changes in one view reflect in the other

Data Consistency

  • Session Tracking: Sessions started in main dashboard appear in Open Cases
  • Status Updates: Resolving findings in details view removes them from Open Cases
  • Audit Trail: Complete tracking across all interfaces

Technical Details

API Integration

  • Endpoint: /open-cases for retrieving active sessions
  • Authentication: JWT ID token required
  • Real-time Data: Current session information with duration calculations
  • Error Handling: Graceful degradation if session tracking is unavailable

Performance

  • Optimized Queries: Efficient retrieval of active sessions only
  • Caching: Appropriate caching for performance without sacrificing real-time updates
  • Responsive Design: Works on desktop and tablet devices

Troubleshooting

Common Issues

Open Cases Not Loading

Symptoms: Empty dashboard or loading spinner Solutions:

  1. Check network connectivity
  2. Verify authentication status
  3. Refresh the page
  4. Check browser console for errors

Session Information Missing

Symptoms: Cases show without analyst information Solutions:

  1. Verify session tracking is enabled
  2. Check DynamoDB connectivity
  3. Confirm analyst started session properly
  4. Wait for next auto-refresh cycle

Navigation Issues

Symptoms: Links not working or 404 errors Solutions:

  1. Ensure complete ARN support is deployed
  2. Check URL encoding/decoding
  3. Verify API Gateway configuration
  4. Clear browser cache

Support and Monitoring

  • CloudWatch Logs: Monitor API Gateway and Lambda logs
  • X-Ray Tracing: Trace request flow for performance issues
  • Error Tracking: Comprehensive error logging for debugging

Best Practices

For Analysts

  1. Check Open Cases First: Always check before starting new investigations
  2. Resolve Promptly: Mark findings as resolved when investigation is complete
  3. Document Progress: Use finding details to document investigation progress
  4. Communicate: Coordinate with team members on complex cases

For Supervisors

  1. Regular Monitoring: Check Open Cases dashboard throughout the day
  2. Load Balancing: Ensure even distribution of work across team
  3. Time Management: Monitor session durations for efficiency
  4. Training: Use session data to identify training opportunities

For SOC Operations

  1. Shift Handoffs: Use Open Cases for smooth shift transitions
  2. Escalation: Monitor high-severity cases for timely escalation
  3. Metrics: Track team performance using session analytics
  4. Process Improvement: Use data to optimize SOC workflows

Future Enhancements

Planned Features

  • Advanced Analytics: Detailed reporting on analyst performance
  • Notifications: Alerts for long-running sessions or high-priority cases
  • Case Assignment: Automated case assignment based on workload
  • Integration: Enhanced integration with ticketing systems

Feedback and Suggestions

  • Use the application feedback mechanisms to suggest improvements
  • Report bugs or issues through standard support channels
  • Participate in user experience surveys for future enhancements