> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident cases

> How to build and run an investigation case by linking multiple alerts, tracking work, and generating reports.

# Incident cases

**Menu:** Incident Management → Cases

Cases are where you **bundle related alerts into one investigation** (example: Wazuh + firewall + third‑party integration alerts) and track the work from triage → resolution.

Deep link tip: you can open/highlight a case directly with:

`/incident-management/cases?case_id=<id>`

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=4da466e1205c295d1d5792cfdcd8aded" alt="Incident Cases" width="1894" height="586" data-path="assets/ui/incident-cases.png" />

***

## What you’re looking at

The Cases view is split into two parts:

* **Cases list** (left): your queue of open/in‑progress/closed cases
* **Case details** (right or modal): the selected case, with tabs like:
  * **Overview**
  * **Alerts** (linked alerts)
  * **Comments**
  * **Data Store**

***

## Step 1 — Create or open a case

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases-details-overview.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=4c7e9df585e08803e3400ee13a73f7d2" alt="Case details (Overview)" width="834" height="468" data-path="assets/ui/incident-cases-details-overview.png" />

1. Open **Incident Management → Cases**
2. Click a case in the list to open **details**
3. Use **Overview** to confirm:
   * case name + description
   * customer (tenant)
   * status + assignee

***

## Step 2 — Link multiple alerts to the same case

A case becomes valuable when it holds *all the signals* for the incident.

Example workflow:

* A **Wazuh** alert fires (endpoint)
* A **firewall** alert fires (network)
* A **third‑party integration** alert fires (cloud / email / EDR)

Link them all to the same case so the case becomes the single place to:

* see the full timeline of signals
* coordinate comments
* generate a consolidated report

### UI callout: Review linked alerts

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases-details-alerts.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=273b661028b4d4fb19842282b672c8a3" alt="Case details (Alerts)" width="834" height="600" data-path="assets/ui/incident-cases-details-alerts.png" />

1. Open the case details
2. Click the **Alerts** tab
3. Confirm all related alerts are listed under this case

> Tip: You can link alerts from the **Alerts** screen as well (operators usually start from an alert, then attach it to an existing case).

***

## Step 3 — Use comments for investigation notes + handoff

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases-details-comments.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=b663b158e82a295858cacdaf410a675f" alt="Case details (Comments)" width="852" height="458" data-path="assets/ui/incident-cases-details-comments.png" />

1. Open the case details
2. Click **Comments**
3. Add investigation notes, decisions, and handoff context

***

## Step 4 — Use Data Store for supporting material

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases-details-datastore.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=0348472c7f759bf8b8e2028bb1cee344" alt="Case details (Data Store)" width="838" height="440" data-path="assets/ui/incident-cases-details-datastore.png" />

Use **Data Store** to keep files tied to the case (exports, screenshots, timelines, supporting artifacts).

***

## Step 5 — Generate a case report (Jinja templates)

Cases can generate reports using templates.

### UI callout: Generate Report

<img src="https://mintcdn.com/socfortressllc/ZF3TjekosrsQhf-4/assets/ui/incident-cases-generate-report.png?fit=max&auto=format&n=ZF3TjekosrsQhf-4&q=85&s=ca4dcb4469de5199d56a756e31bc50e8" alt="Generate report modal" width="612" height="360" data-path="assets/ui/incident-cases-generate-report.png" />

1. Open the case details
2. In **Overview**, click **Generate Report**
3. Choose a **Template**
4. Enter a **Filename**
5. Click **Generate**

Template notes:

* Templates are **customizable** and support **Jinja** templating.
* Different template types may generate different outputs (for example: a `.docx` template vs an `.html` template used to generate a PDF).

***

## Common gotchas

### “Why can’t I find all alerts for this incident in one place?”

Make sure you link each relevant alert (endpoint + network + third‑party) into the same case via the **Alerts** tab.

### “My report template isn’t available in the dropdown”

Report templates are managed in the template manager (your environment may restrict who can upload/manage templates).


Built with [Mintlify](https://mintlify.com).