Case Management

Case Management tracks, investigates, and responds to security incidents. Detected events are registered as cases and investigated collaboratively by the team.

---

Screen Layout

Case List

The case list screen shows registered cases in a table view.

• Filter Bar for filtering by status, classification, containment, and tags.
• Statistics Panel showing case counts and the status breakdown.
• Case Table giving a summary view of each case.

Case Detail

Opening an individual case reveals its investigation detail.

• Thread View for conversation-style incident investigation.
• Messages, the individual alerts and events attached to the case.
• AI Analysis Flow Graph, a visual representation of the investigation steps.

---

Case Statuses

Status	Description
Open	Newly created case, not yet triaged
In Progress	Under active investigation
Resolved	Investigation complete, response actions taken

---

Case Operations

Creating a Case

1. Click Create New on the case list screen.
2. Enter the case title and description.
3. Save to register the case.

Cases can also be created automatically by detection rules (UEBA tasks, Playbook triggers).

Filtering

Cases can be filtered using the following criteria.

Filter	Description
Status	Open / In Progress / Resolved
Classification	Threat classification category (e.g., intrusion-attempt, malware, data-exfiltration)
Containment	Containment status
Tags	Custom tag-based filtering
Date Range	Creation date range

Tag Management

Apply custom tags to cases to organize them by your own classification scheme. Tags can be set and filtered via the API using the X-SOCEngine-Tags header.

curl "https://<domain>/api/user/<user_id>/messages/" \
  -H "Cookie: jwt=<token>" \
  -H "X-SOCEngine-Tags: {\"severity\": \"high\"}"

---

AI-Powered Features

Note

These features assist with search, analysis, and presentation. The AI does not automatically respond, remediate, block traffic, or close cases.

Similar Case Search

From the case detail screen, click Similar Cases to find past cases by similarity. Cases are ranked by similarity of the case text. It returns past cases that resemble the current one, each with a similarity score.

How it works:

1. Open a case.
2. Click Similar Cases.
3. The system returns a ranked list of past cases with similarity scores.

{
  "similar_cases": [
    {
      "id": "msg-042",
      "title": "Brute Force from External IP",
      "similarity_score": 0.92,
      "status": "resolved"
    }
  ]
}

Recommendations

Click Recommend to surface related cases and dashboards. Recommendations combine case similarity with access-history weighting. They present past similar cases and frequently referenced items, rather than an independent model deciding the single "best" response.

AI Analysis and Flow Graph

The Run AI Analysis action has the AI investigate an alert through PRQL queries and produce a false-positive or true-positive report with rationale. Posting that result to the thread is a manual user action. The Analysis Flow Graph is a display-only view of the analysis's reasoning and tool-execution steps (Reasoning, Tool, Result). The AI does not separately generate or execute a flowchart from this view.

See also: AI Investigate, the full-screen read-only AI assistant, and the case-level AI chat.

---

Case Sharing via URL

Each case and message has a unique URL. Share the URL with team members to give them direct access to a specific case.

/user/{userId}/case/thread/{threadId}/message/{messageId}

---

Case Lifecycle

A typical case follows this lifecycle.

1. Detection: a UEBA task or Playbook detects an anomaly and creates a case automatically with status Open.
2. Triage: an analyst picks up the case and changes the status to In Progress.
3. Investigation: the analyst uses Similar Case Search and AI Recommendations for investigation guidance.
4. Response: response actions are carried out by analysts. Any action that writes to an integration is approval-gated (request, approve, then apply), so it is not executed without review.
5. Resolution: the case is marked Resolved once the response is complete.

---

API Operations

Case management is fully accessible via the REST API. See the API Reference for complete endpoint documentation, including the following.

• GET /api/user/<user_id>/messages/ to list cases
• POST /api/user/<user_id>/messages/ to create a case
• PATCH /api/user/<user_id>/messages/ to update a case
• GET /api/user/<user_id>/messages/<message_id>/similar/ for similar case search
• GET /api/user/<user_id>/messages/<case_id>/recommend/ for AI recommendations