diff --git a/explore-analyze/alerts-cases/cases/manage-cases.md b/explore-analyze/alerts-cases/cases/manage-cases.md index a079c774fc..64b4d89689 100644 --- a/explore-analyze/alerts-cases/cases/manage-cases.md +++ b/explore-analyze/alerts-cases/cases/manage-cases.md @@ -138,3 +138,11 @@ To view a case, click on its name. You can then: * Change the severity. * Close or delete the case. * Reopen a closed case. + +## Search and filter by case ID [cases-id] + +```{applies_to} +stack: ga 9.2 +``` + +Existing and new cases are automatically assigned numeric IDs, which display after the case name. Use these IDs to quickly search and filter the Cases table. You can also use them for simplified tracking and collaboration when communicating about a case. diff --git a/solutions/observability/incident-management/create-manage-cases.md b/solutions/observability/incident-management/create-manage-cases.md index de5d3c8adc..80668a25a5 100644 --- a/solutions/observability/incident-management/create-manage-cases.md +++ b/solutions/observability/incident-management/create-manage-cases.md @@ -98,4 +98,12 @@ To view a case, click on its name. You can then: * Remove an alert. * Refresh the case to retrieve the latest updates. * Close the case. -* Reopen a closed case. \ No newline at end of file +* Reopen a closed case. + +## Search and filter by case ID [cases-id] + +```{applies_to} +stack: ga 9.2 +``` + +Existing and new cases are automatically assigned numeric IDs, which display after the case name. Use these IDs to quickly search and filter the Cases table. You can also use them for simplified tracking and collaboration when communicating about a case. \ No newline at end of file diff --git a/solutions/security/investigate/open-manage-cases.md b/solutions/security/investigate/open-manage-cases.md index a15186be2f..0ce257b07f 100644 --- a/solutions/security/investigate/open-manage-cases.md +++ b/solutions/security/investigate/open-manage-cases.md @@ -147,8 +147,6 @@ To explore the alerts attached to a case, click the **Alerts** tab. In the table Each case can have a maximum of 1,000 alerts. :::: - - ### Add files [cases-add-files] To upload files to a case, click the **Files** tab: @@ -328,3 +326,11 @@ To import a case: * If the imported case had attached alerts, verify that the alerts' source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts' source documents to function. :::: + +## Search and filter by case ID [cases-id] + +```{applies_to} +stack: ga 9.2 +``` + +Existing and new cases are automatically assigned numeric IDs, which display after the case name. Use these IDs to quickly search and filter the Cases table. You can also use them for simplified tracking and collaboration when communicating about a case.