Detailed Explanation of Subflow 2.3 - Link Alert to Existing Case
The Subflow 2.3 - Link Alert to Existing Case is an important part of the “On New Table Record - Process Alert” workflow and directly supports Subflow 2 - Create Case. Its main role is to determine if an incoming alert should be linked to an existing case or if a new case needs to be created. This prevents duplication, keeps the case management system organized, and ensures alerts are grouped appropriately. Additionally, it updates the case’s severity when necessary, helping analysts prioritize and respond effectively.
Once the alert has been processed and deduplicated (via the Subflow 2.1 - Get Duplication Rule Workflow and the Subflow 2.2 - Check for Case Duplicates), Subflow 2.3 - Link Alert to Existing Case steps in to link the alert to the most relevant existing case. If the alert is identified as a duplicate, this subflow uses key observables (such as “File Hash,” “IP Address,” or “URL”) to search for an existing case that matches the alert’s details. For example, if the alert contains an observable like File Hash: SHA256: abc123...
or an IP address, the subflow will search for cases with the same observables.
Once the relevant case is identified, Subflow 2.3 - Link Alert to Existing Case links the alert to that case. This helps to maintain organized case management by consolidating related alerts into one case, preventing redundancy. Additionally, if the alert’s severity is higher than the linked case’s severity, the subflow updates the case’s severity to match the alert’s, ensuring the case reflects the highest level of urgency.
File Hash: SHA256: abc123...
and severity High
is processed.High
.