Welcome to
Chronicle SOAR Product Documentation
Working with Cases
Cases Overview
What’s on the Cases Screen?
What's on the Case Queue Header?
What's on the Case Overview Tab?
What's on the Case Wall Tab?
Instant Messaging on a Case
Manage Tasks from the Cases Screen
Perform a Manual Action
Manage Tags from the Cases Screen
What actions can you take on a case?
Mark a Case as an Incident
Simulate Cases
Create a test case
How to close Cases
View the contents of closed cases
Define Tags in Cases (Admin)
Define Default View for Cases (Admin)
Add/Delete Case Stages (Admin)
Alert Options Menu in the Cases Screen
View the original SIEM data in a case
Explore Entities and Alerts (Investigation)
What Entity types do we support?
Navigating the Entity Explorer screen
Perform a batch action on several cases at once
Leverage Case stages to increase ROI (Video)
Measure how long security analysts take to close or raise a Case
Add new Case Close Root Cause (Admin)
Naming a Case (Admin)
Create a Manual Case
Move Case to a new Environment
Add or Edit Entity Properties
Apply and Save Filters
AI Investigation Widget