The primary way to create cases is through the Case Rules tab.
A case is the primary unit of investigation. It groups related security alerts or behavioral signals for a user into a single workable item that can be assigned, investigated by AI, and resolved.
Cases are created automatically when security alerts match a configured rule and cross a volume or severity threshold. They represent a cluster of related policy violations by a user within a time window (e.g., 30+ downloads from a sanctioned cloud app within 30 minutes).
Each rule card shows the rule name, creation date, and enabled/disabled status. Cards for disabled rules show a “Disabled” badge and the name is struck through.
Toolbar controls:
- Search — Filter rules by name (prefix match)
- Status filter — Show All, Enabled only, or Disabled only
- Sort — Sort by Created At (default) or Rule Name, ascending or descending
Case Rules
To create a new rule:
- Click the + Create button in the top-right of the Case Rules page
- The side panel opens in create mode with an empty form
- Enter a Rule Name (required, max 255 characters, must be unique)
- Write the rule query in the PQL editor
- Click Create to save the rule (it is created in a disabled state)
- Review the rule, then toggle Enabled when ready
See the PQL Reference for more information.
Editing an Existing Rule
- Click a rule card to open the details panel
- Click the Edit (pencil) icon
- Modify the rule name and/or query
- Click Save
Rule Examples
Rapid Bulk Download
Creates a case if a user downloads 30+ files from a sanctioned app in 30 minutes.
filter incident.dlp_user_activity = 'download' case_insensitive
AND incident.app_instance_is_sanctioned = true
| time_window 30m tumbling
| create_case group_by incident.user when group.evidence_count >= 30
High Severity DLP
Creates a case immediately upon a single high-severity incident.
filter incident.dlp_incident_severity = 'High'
| create_case group_by incident.user when group.evidence_count >= 1
UDM Field Reference (Commonly Used)
| Catégorie | Fields |
|---|---|
| File | incident.file_type, incident.file_size, incident.file_exposure |
| App | incident.app_name, incident.app_instance_is_sanctioned, incident.app_category |
| User | incident.user, incident.user_confidence_index |
| DLP | incident.dlp_rule_names, incident.dlp_policy_name, incident.dlp_user_activity |
dlp_rule_names sont des tableaux. Utilisez toujours l'opérateur contains pour la correspondance (par exemple, filter incident.dlp_rule_names contains 'SSN').Creation from Views
Cases can also be created from the Data Loss or Insider Threats views.
Data Loss
To create a case from the Data Loss view, click on one of the incidents and hit Create Case from the Insight view.
Insider Threats
To create a case from the Insider Threats view, click on one of the users in the User Watchlist and hit Create Case from the Insight view.
Case Details
Une fois une affaire créée, cliquer dessus ouvre le panneau des détails de l’affaire, qui fournit un contexte sur la manière dont l’affaire a été générée et des outils pour suivre l’enquête.
Case Attribution
L’en-tête des détails de l’affaire inclut une puce indiquant comment le dossier a été créé : généré par le système, manuel ou liste de surveillance.
Pour les cas créés manuellement, l’en-tête affiche également un champ Investigated by montrant l’adresse e-mail de l’analyste qui a initié l’enquête. Pour les exécutions initiées par le système, ce champ affiche Automatic investigation.
Incident Context
Les incidents provenant d’une activité de navigation web affichent le nom et l’URL du site directement dans le panneau latéral de l’incident, offrant ainsi aux analystes un contexte immédiat sans avoir à recouper d’autres outils.
Investigation Trail
La trace d’enquête affiche chaque étape effectuée par l’IA ou par un analyste pendant l’enquête. Chaque marche du sentier peut être agrandie ou effondrée indépendamment, vous permettant de vous concentrer sur des pas spécifiques sans perdre votre place dans le reste du sentier.