You can add one or more alerts to an existing case from the Alerts page. After 90 days a read-only version of the alert and its associated events remains available until 13 months after the alert was generated. This allows you to see the full context of a case after 90 days, as well as retaining this information for audit purposes.
To add an alert from an existing case:
Open the case, select the Related Alerts tab, and then click Add Alerts.
Select all the alerts you want to add to the case, and then click Add Alerts.
To add alerts to an existing case from the alerts page:
On the Alerts page, do one of the following:
For a single alert, at the end of the alert row click More Options
.png "more-options.png")
> Add to Existing Case.For multiple alerts, select the checkbox next to each alert and click Actions > Add to Existing Case.
Enter the Case ID, choose a recent case, or select View All Cases to open the Cases page.
You can add an artifact to an existing case from the Case Timeline tab on the case details page.
To add an artifact to an existing case:
Open the case and select the Case Timeline tab.
Click Actions > Add artifact.
In the dialog, select a type of artifact from the menu, enter a name, and an optional note.
Click Create.