The Case Management interface includes multiple interconnected tables — Cases, Alerts, Attachments, Observables, and Tasks — each designed to help you track and respond to security incidents with precision.

This guide explains the universal features available across all tables in the Case Management interface. Regardless of which table you are viewing, you can access the same set of management tools to organize, filter, and take action on records efficiently.

Note:The images below serve as examples of the general case management table’s layout. However, All tables interfaces in the ‘Case Management’ feature include all the below to simplify the management of the Case Management interface.

​
Select Multiple Records

Quickly take action on multiple cases. You can select multiple cases using the checkboxes next to each row in the table. Once selected, a floating toolbar will appear at the top of the screen, allowing you to:

  • Change the status of selected cases
  • Export selected cases to CSV
  • Delete selected cases

​
Responses

The Response field allows you to configure and trigger incident response workflows for each table. These workflows can be tailored to match your operational needs for Cases, Alerts, Attachments, Observables, and Tasks.

Quickly find records by name, tags, and other metadata. Use the search to find records by entering keywords such as case names, tags, vendors, or overviews.

Searchable fields include Name, Vendors, MITRE mappings, Tags, Close Reasons, and Overviews. Supported data types include Text, Single-Select, Multi-Select, and List.

​
The Refresh Button

All tables automatically refresh every 5 minutes. You can view the last refresh time by hovering over the refresh button at the top right. Click the button to manually refresh the data at any time.

​
The View Button

The table contains additional fields, but only a few are initially visible by default. Click on the icon above the table, to configure which table field columns you want to make visible and choose which table field columns you want to remain hidden.

​
The Filter Button

The ‘Filter’ button simplifies filtering through case(s) by applying conditional statements to find the specific case(s) you are looking for.

​
Table Views

Create and manage personalized or shared table views.

Each table offers pre-configured views (e.g., All Cases, My Tasks, Critical Alerts) and lets you create custom views with filters and layout preferences.

​
Filter Custom Tables by Case Type.

In your Custom Table, if you choose to display the “Linked Cases” column, you can configure it to filter the table by a specific Case Type.

1

Show the Linked Cases Column

After creating your Custom Table, click the button and check the box next to the “Linked Cases” field. This will display the “Linked Cases” column in your Custom Table.

2

Filter by Specific Case Types

Next, click the icon next to “Linked Cases” and select “Edit.” A popup will appear. In the “Filter By Type” section, check the box next to the Case Types you want to filter the Custom Table by. If you do not select a Case Type under “Filter By Type” section, the Custom Table will be presented on all Cases.

3

View the Filtered Table in Case Overview

When viewing a Case, your Custom Table will now only appear as a separate tab if the Case’s Case Type matches one of the types you selected in the previous step.