Managing Cases
The Case Management interface includes multiple interconnected tables, Cases, Alerts, Attachments, Observables, and Tasks, each designed to help you track and respond to security incidents with precision.
This section of the documentation explains the universal features available across all tables in the Case Management interface. Regardless of which table you are viewing, you can access the same set of management tools to organize, filter, and take action on records efficiently.
All table data is securely stored in an encrypted Amazon RDS instance. Each customer’s data is isolated within a dedicated PostgreSQL schema, and all encryption is managed using AWS Key Management Service (KMS).
For customers who purchased Blink through the Azure Marketplace or have specifically requested Azure services, all table data is securely stored in an encrypted Azure Database for PostgreSQL. Each customer’s data is isolated in a dedicated PostgreSQL schema, with encryption fully managed by Azure to ensure data security and compliance.
Select Multiple Records
Quickly take action on multiple cases. You can select multiple cases using the checkboxes next to each row in the table. Once selected, a floating toolbar will appear at the top of the screen, allowing you to:
- Change the status of selected cases
- Export selected cases to CSV
- Delete selected cases
Responses
The Response field allows you to configure and trigger incident response workflows for each table. These workflows can be tailored to match your operational needs for Cases, Alerts, Attachments, Observables, and Tasks.
Instructions: Configuring The Response Field
Instructions: Configuring The Response Field
The ‘Response’ field enables you to add incident response workflows, customized for each table of the Case Management interface. The workflows associated with a table can be then activated by Case Management users.
Select the icon and an edit option will appear.
A popup will appear with the option to ‘Add Action’.
Proceed to select the ‘Add Action’ option and give the new action a name, choose the desired Workflow, enable for types and then click the apply configuration button.
You will have the choice to either add another action or save the one you just made.
Once completed and saved, you can then trigger all the workflow actions within the dropdown menu for actions.
The Search Bar
Quickly find records by name, tags, and other metadata. Use the search to find records by entering keywords such as case names, tags, vendors, or overviews.
The Refresh Button
All tables automatically refresh every 5 minutes. You can view the last refresh time by hovering over the refresh button at the top right. Click the button to manually refresh the data at any time.
The View Button
The table contains additional fields, but only a few are initially visible by default. Click on the icon above the table, to configure which table field columns you want to make visible and choose which table field columns you want to remain hidden.
The Filter Button
The ‘Filter’ button simplifies filtering through case(s) by applying conditional statements to find the specific case(s) you are looking for.
Table Views
Create and manage personalized or shared table views.
Each table offers pre-configured views (e.g., All Cases, My Tasks, Critical Alerts) and lets you create custom views with filters and layout preferences.
Instructions: Configuring Table Views
Instructions: Configuring Table Views
Navigate to the Dropdown Menu
In the dropdown menu in the top-left corner, you will find out of the box options for reviewing your case: all cases, my cases, high & critical severity, or closed cases.
Customize Table View
You can also create your own table view by selecting the dropdown menu in the top-left corner, choosing the “Add View” option, and providing a name. If you want the table view to be private, check the corresponding box.
- If you check the box next to “Private” this view will be private to other users. Otherwise, it will be public to all users.
Create Conditional Statements
Proceed by creating a conditional statement you would like to apply to the table view you just created. You can also click on the icon to choose which columns you would like to display, drag columns to change their order in the table or sort the columns by hovering over the column headers and clicking the up or down arrow. Then click “Save View.”
You can also edit the Table View you created by clicking on the dropdown menu and selecting the ‘Manage View’ option. To make any changes, click the “Manage View” button. If you want to delete the view you created, click the button.
Filter Custom Tables by Case Type.
In your Custom Table, if you choose to display the “Linked Cases” column, you can configure it to filter the table by a specific Case Type.
Show the Linked Cases Column
After creating your Custom Table, click the button and check the box next to the “Linked Cases” field. This will display the “Linked Cases” column in your Custom Table.
Filter by Specific Case Types
Next, click the icon next to “Linked Cases” and select “Edit.” A popup will appear. In the “Filter By Type” section, check the box next to the Case Types you want to filter the Custom Table by. If you do not select a Case Type under “Filter By Type” section, the Custom Table will be presented on all Cases.
View the Filtered Table in Case Overview
When viewing a Case, your Custom Table will now only appear as a separate tab if the Case’s Case Type matches one of the types you selected in the previous step.