Add search results to a case

You can add search results to new or existing cases on the Search page.

Note

If you have federated view permissions, for example managed security service providers (MSSPs), you can only add search results for a single organization to a new or existing case.

To add a search result to a new case:

On the Search page, enter your criteria in the search bar and click Search.
In the search results table, select each alert you want to add to the case.
At the end of the row select More Options > Add to new case.

To add a search result to an existing case:

On the Search page, enter your criteria in the search bar and click Search.
In the search results table, select each alert you want to add to the case.
At the end of the row select More Options > Add to existing case.
Enter the Case ID, choose a recent case, or select View All Cases to open the Cases page.