Linking cases based on shared attributes or findings during investigations provides a comprehensive view of the incident landscape, allowing anyone reviewing the case to quickly understand the context and connections.
For instance, multiple cases from a phishing campaign, each with unique observables, can be linked based on investigation findings. This helps provide a comprehensive view of the threat.
Linking Cases
Access the Cases Page:
Navigate to the Cases page.
Select and expand the case you wish to link.
Initiate Linking:
Go to the Linked Cases tab.
Click on Link A Related Case and choose the cases you want to link.
Define the Relationship:
Specify the nature of the relationship between the cases: parent of, child of, duplicate of, duplicate by, blocking, blocked by, or Other.
Click Link to finalize.
Manage Linked Cases:
Use the Relations filter at the bottom right to view cases linked by a specific relation.
Select any link to delete it or modify the relation.
Access linked cases directly by clicking on them.
