The primary way to create cases is through the Case Rules tab.
A case is the primary unit of investigation. It groups related security alerts or behavioral signals for a user into a single workable item that can be assigned, investigated by AI, and resolved.
Cases are created automatically when security alerts match a configured rule and cross a volume or severity threshold. They represent a cluster of related policy violations by a user within a time window (e.g., 30+ downloads from a sanctioned cloud app within 30 minutes).
Each rule card shows the rule name, creation date, and enabled/disabled status. Cards for disabled rules show a “Disabled” badge and the name is struck through.
Toolbar controls:
- Search — Filter rules by name (prefix match)
- Status filter — Show All, Enabled only, or Disabled only
- Sort — Sort by Created At (default) or Rule Name, ascending or descending
Case Rules
To create a new rule:
- Click the + Create button in the top-right of the Case Rules page
- The side panel opens in create mode with an empty form
- Enter a Rule Name (required, max 255 characters, must be unique)
- Write the rule query in the PQL editor
- Click Create to save the rule (it is created in a disabled state)
- Review the rule, then toggle Enabled when ready
See the PQL Reference for more information.
Editing an Existing Rule
- Click a rule card to open the details panel
- Click the Edit (pencil) icon
- Modify the rule name and/or query
- Click Save
Rule Examples
Rapid Bulk Download
Creates a case if a user downloads 30+ files from a sanctioned app in 30 minutes.
filter incident.dlp_user_activity = 'download' case_insensitive
AND incident.app_instance_is_sanctioned = true
| time_window 30m tumbling
| create_case group_by incident.user when group.evidence_count >= 30
High Severity DLP
Creates a case immediately upon a single high-severity incident.
filter incident.dlp_incident_severity = 'High'
| create_case group_by incident.user when group.evidence_count >= 1
UDM Field Reference (Commonly Used)
| Category | Fields |
|---|---|
| File | incident.file_type, incident.file_size, incident.file_exposure |
| App | incident.app_name, incident.app_instance_is_sanctioned, incident.app_category |
| User | incident.user, incident.user_confidence_index |
| DLP | incident.dlp_rule_names, incident.dlp_policy_name, incident.dlp_user_activity |
dlp_rule_names are arrays. Always use the contains operator for matching (e.g., filter incident.dlp_rule_names contains 'SSN')Creation from Views
Cases can also be created from the Data Loss or Insider Threats views.
Data Loss
To create a case from the Data Loss view, click on one of the incidents and hit Create Case from the Insight view.
Insider Threats
To create a case from the Insider Threats view, click on one of the users in the User Watchlist and hit Create Case from the Insight view.
Case Details
Once a case is created, clicking it opens the case details panel, which provides context on how the case was generated and tools to track the investigation.
Case Attribution
The case details header includes a chip indicating how the case was created: system-generated, manual, or watchlist.
For manually created cases, the header also displays an Investigated by field showing the email of the analyst who initiated the investigation. For system-initiated runs, this field displays Automatic investigation.
Incident Context
Incidents originating from web browsing activity display the site name and URL directly in the incident side panel, giving analysts immediate context without needing to cross-reference other tools.
Investigation Trail
The investigation trail displays each step AI or an analyst took during the case investigation. Each step in the trail can be independently expanded or collapsed, allowing you to focus on specific steps without losing your place in the rest of the trail.