Case Management Layout v2

Info

Notes

Work Plan

Team Members

Closing Information

Details

Quick Actions

Timeline Information

Indicators

All associated indicators with the current incident.

Linked Incidents

Labels

Analyst Tools

Quick Actions

Response Process

Useful Commands

### Investigation / Enrichment | Command | Functionality | | --- | --- | | !DomainReputation | Checks Domain reputation | | !FileReputation | Checks reputation of a File hash | | !IPReputation | Checks IP address reputation | | !URLReputation | Checks URL reputation. | | !ExtractIndicatorsFromTextFile | Extracts IOCs from text file | | !ExtractIndicatorsFromWordFile | Extracts IOCs from Word file | | !ReadPDFFileV2 | Extracts IOCs from PDF file | ### Data Manipulation | Command | Functionality | | --- | --- | | !Base64Decode | Decodes base64-encoded input | | !Base64EncodeV2 | Encodes input into base64 | | !UnEscapeIPs| Removes escape characters [ ] from IP(s) | | !UnEscapeURLs | Removes escape characters from URLs | | !UnzipFile | Unzips a file (supports password protection) | | !ZipFile | Zips a file with optional password |

War Room Entries

War Room entries can be created from the Command Line Interface (CLI), and are **markdown friendly**. | Markdown | Description | | --- | --- | | \#Incident ID | Reference other Incidents in the War Room | | \*\*Bold\*\* | **Bolds** the text | | \*Italics\* | *Italics* the text | | \*\*\*Both\*\*\* | ***Bold and Italics*** | | \+Underline\+ | +Underline+ | | \{\{color\:red\}\}\(This text will be in red\) | {{color:red}}(This text will be in red) | | \{\{color\:blue\}\}\(This text will be in blue\) | {{color:blue}}(This text will be in blue) | | \{\{color\:green\}\}\(This text will be in green\) | {{color:green}}(This text will be in green) | | \{\{background\:red\}\}\(This text will be highlighted red\) | {{background:red}}(This text will be highlighted red) | | \{\{background\:blue\}\}\(TThis text will be highlighted blue\) | {{background:blue}}(This text will be highlighted blue) | | \{\{background\:green\}\}\(This text will be highlighted\) | {{background:green}}(This text will be highlighted) | | \# Heading 1 | Heading Level 1 | | \#\# Heading 2 | Heading Level 2 | | \#\#\# Heading 3 | Heading Level 3 | ### Markdown Tables \| Column A \| Column B \| Column C \| \| \-\-\- \| \-\-\- \| \-\-\- \| \| A1 \| B1 \| C1 \| \| A2 \| B2 \| C2 \| \| A3 \| B3 \| C3 \| ### War Room Filters - The War Room can be filtered based on Actions, Tags, or Users. - Set or review filters from the top of the War Room tab. - Make sure to review your filters so you don't potentially miss important information.

Working Incidents

| Item | Notes | | --- | --- | | Assign an Owner | Select Owner via the **Owner field**, or use the **+Assign to Me button+** to assign to yourself | | Closing an Incident | Select **+Actions -> Close Incident+**, and complete close notes and reason | | Editing an Incident | Select **+Actions -> Edit+**, or edit the field on the layout | | Linking Incidents | Use the **+Link Incidents button+** or run !linkIncidents in the CLI | | Closing as Duplicate | Use the **+Close as Duplicate button+** or run **!CloseInvestigationAsDuplicate** in the CLI | | Inviting a Team Member | You can tag team members with **@username**, or select the 3-dots, and select Team. | | Restrict Incident | Restricts the Incident to only invited Team Members. Select **+Actions -> Restrict Incident+** | ### Notes - Mark entries as a Note by selecting **+Actions -> Mark as Note+** on the war room entry. - Notes are important information that you want to make it easy for others to find and read. - Screenshots and images can be uploaded in line to Notes via the Command Line Interface (CLI) - Notes can be tagged, and war room filters applied to view Notes with specific tags. ### Evidence - Mark entries as Evidence by selecting **+Actions -> Mark as Evidence+** on the war room entry. - Evidence can be reviewed on the Evidence Board.