Case Management

CYBERQUEST provides a case management module designed to help organizations and users to create and track workflows in order to quickly address incidents. Every case created has an owner which can assign collaborators to enhance the decision-making process and streamline the case resolution. The case allows adding of all existing evidence based on the event or alert that led to creation of the case.

Overview

The Case Management module can be accessed by selecting the Case Management button in the left-side menu of the Web Interface. The module opens on the Cases page, which lists the existing investigations and provides the controls for filtering, searching, and managing them.

The navigation buttons at the top of the page give access to all areas of the module:

• Cases - The list of investigation cases, described on this page.
• Case Statistics - A graphical summary of case activity. See Case Statistics.
• DORA Journey - Compliance tracking for the Digital Operational Resilience Act. See DORA Journey.
• SLA - Service Level Agreements and the case escalation switch. See SLA and Case Escalation.
• Case Levels - Responsibility levels used for escalation. See Case Levels.
• Case Templates - Reusable sets of custom fields for cases. See Case Templates.

To start a new investigation, click the button below the navigation buttons. See Create a New Case.

The summary cards on the right show the number of cases that match the current selection: Total, Open, SLA Warnings (cases with an SLA problem, such as an exceeded response or confirmation deadline), and Closed.

Filter and Search Cases

The toolbar above the case list controls which cases are displayed:

• Status drop-down (first on the left) - Filters cases by status. Each option shows the number of matching cases:
  • All - Every case, regardless of status.
  • Active - Cases with the New or Open status.
  • New - Recently created cases awaiting initial triage and assignment.
  • Open - Active investigations currently being worked on by the security team.
  • Solved - Cases marked as solved.
  • Closed - Cases that have been finalized and closed.
  • Archived - Cases archived for record-keeping or future reference.
• Template drop-down - Shows only the cases created from a selected case template. Templates are managed on the Case Templates page.
• Reports - Opens the report generation window. See Generate Reports.
• Export CSV - Downloads the cases currently displayed in the list as a CSV file.
• Bulk Select - Changes the status of several cases at once. See Bulk Status Changes.
• Filters - Shows or hides the date filter panel.
• Columns - Chooses which columns are displayed in the list.
• My Cases - When selected, shows only the cases where the currently authenticated user is the owner.
• Created by Me - When selected, shows only the cases created by the currently authenticated user.
• Search - Quick search box for locating a specific case.

Click Filters to display the date filter panel. Select a Start Date and an End Date, then choose in Date Column which case date the interval applies to: Created, Modified, Close Time, Reopen Time, Archive Time, Solve Time, or Open Time. Click Reset Filters to return to the default interval.

Click Columns to show or hide optional columns. The number on the button indicates how many columns are currently hidden. The optional columns are Severity, Root cause, ID, Types, Users, Open Time, Reopen Time, Close Time, and Created. Click Reset to default to restore the default column set.

Click a column header marked with an arrow to sort the list by that column.

Case List Columns

The Response Remaining / Confirmation Remaining columns provide critical visibility into service level agreement (SLA) compliance, ensuring timely incident response and resolution. These metrics help security teams prioritize cases and meet regulatory requirements.

• Response Due Time: Indicates the deadline for initial case acknowledgment and assignment. This is the time by which the security team must acknowledge the case and begin initial investigation.
• Confirmation Due Time: Represents the deadline for confirming the resolution of the case. This is the time by which the security team must confirm that all necessary remediation steps have been taken and the incident is fully resolved.
• Response Remaining: Shows the time remaining until the Response Due Time is reached. If this time has passed, it indicates how much time has elapsed since the deadline was missed.
• Confirmation Remaining: Shows the time remaining until the Confirmation Due Time is reached. If this time has passed, it indicates how much time has elapsed since the deadline was missed.

The Severity column shows the case severity (critical, high, medium, or low). When the case type has no SLA of its own, the severity supplies the default SLA for the case.

Case Actions

Each row of the case list provides the following action buttons in the Actions column:

• Quick Preview - Opens a side panel with a summary of the case. See Quick Preview.
• Add Note - Adds an investigation note to the case without opening it.
• Download Report - Downloads a report for the case.
• Edit Case - Opens the case for editing. See Edit Case.
• Delete Case - Deletes the case after a confirmation.
• More Actions - Opens a menu with additional actions: Add Deduplicate Item, Set Deduplicate Of (see Cases Manual Deduplication), Change User Classification (see Change User Classification), and, when a ticketing provider is configured, Attach ticket (see Attach a Ticket).

The buttons available depend on the permissions of the current user. For example, Download Report requires the right to export data, and Delete Case requires the right to delete cases.

To change the status of a case directly from the list, click its status badge in the Status column and select the new status (for example Open, Solve, or Close).

Click the arrow at the start of a row to expand it. The expanded row displays the incident reports of the case and lets you initialize a new DORA or NIS2 report directly from the list, in the same way as the Incident Reports tab.

Bulk Status Changes

Click Bulk Select to change the status of several cases in one operation. A checkbox appears at the start of each row, and a bar with the bulk actions is displayed above the list: Bulk REOPEN, Bulk OPEN, Bulk SOLVE, Bulk CLOSE, and Bulk ARCHIVE.

Select the cases to update (use the checkbox in the header to select all the cases on the page), then click the desired bulk action. Click Cancel to leave the bulk selection mode.

Quick Preview

Click the button to open the Quick Preview panel. It displays the case name and status, the case ID, the lifecycle dates (Created, Opened, Modified, Closed, Reopened, Archived), the case types, the assigned users, and the SLA timers. Click Open Full View to open the case details page.

Detailed Case View

Click the case name in the list, or Open Full View in the Quick Preview panel, to open the case details page.

The top of the page shows the case name, its current status, and the Response Remaining and Confirmation Remaining SLA timers. The following actions are available below the case name:

• Run PlayBook - Runs a playbook or a single action using the case data as input. See Run a PlayBook on a Case.
• Add Note - Adds an investigation note to the case.
• Edit - Opens the case for editing. See Edit Case.
• Actions - Changes the case status (Open, Solve, Close; the options depend on the current status) or opens Change User Classification.

Click Cases in the breadcrumb at the top of the page to return to the case list.

The case details page is organized into several tabs:

Overview

The Overview tab displays the main information about the selected case:

• Case Information - Case ID, name, description, status, types, assigned users, owner, severity, root cause, resolution, verdict, user classification, and the creation and last modification dates.
• SLA Information - The SLA policy applied to the case, the response and confirmation due times and remaining times, the SLA problem indicator, and the open, close, solve, reopen, and archive times. The Configure case type SLA link opens the SLA page.
• Duplication Info - The deduplication details of the case. See Cases Manual Deduplication.

When case escalation is enabled (see SLA and Case Escalation), the Overview tab also contains a Case escalation section. It shows the current case level, allows selecting a different level with Save case level, and escalating the case to the next level by entering an Escalation reason and clicking Escalate case. The Escalation history table lists all previous escalations of the case.

Timeline

The Timeline tab provides a chronological history of all actions performed on the case. It helps users track case activity, such as creation, updates, collaborator changes, and evidence additions. Entries that add an alert as evidence include a Display Alert link that opens the alert.

Notes & Evidence

The Notes & Evidence tab displays notes and evidence items associated with the case.

The Notes area shows comments or investigation notes added by users, with the time each note was added. If no notes are available, the interface displays a no-notes message.

The Evidence area lists uploaded or attached evidence items, such as logs, screenshots, exported alerts, or other supporting files. Evidence entries include the user who added the item and the timestamp. For alerts added as evidence, click Display Alert to review the alert.

To attach more alerts to the case, click Add alert. In the window that opens, select the time interval (Last 24 hours, Last 7 days, Last 30 days, or Last 90 days), search for and select the alerts, optionally enter a Note explaining why the alerts belong to the case, and click Add alert. Alerts already linked to the case are marked as Already linked.

Incident Reports

The Incident Reports tab allows users to initialize and manage incident reports associated with the case.

From this view, the user can select the reporting framework, such as DORA or NIS2, choose the relevant incident report category, select the report type, and click Initialize to create the report.

This section is used to support regulatory reporting workflows by linking incident documentation directly to the investigation case. If no reports have been created, the interface displays a no incident reports message.

Run a PlayBook on a Case

Click Run PlayBook on the case details page to run an automation on the case. Select PlayBook to run a complete playbook, or Single Action to run one action. Choose the playbook from the PlayBook drop-down list and, if required, add input parameters with Add Parameter. The right side of the window shows the case data passed to the playbook. Keep Wait for Result enabled to wait for the execution result, then click Run.

Playbooks are created and managed in the PlayBooks module.

Cases Manual Deduplication

Manual deduplication allows analysts to link cases that are determined to be related or identical based on their investigation. This process streamlines case management, reduces redundancy, and ensures that all relevant information is consolidated under the most appropriate case.

To start manual deduplication, click the button on the case row. From the actions menu, select Add Deduplicate Item.

After the case is added as a deduplication item, open the actions menu of the duplicate case and select Set Deduplicate Of. This option allows the user to choose the primary case that the current case will be linked to as a duplicate.

In the deduplication selection window, review the selected cases and the Duplicate Of relationship. After confirming the selection, click the confirmation button to apply the deduplication relationship.

Deduplication Options:

• Add Deduplicate Item: Adds the current case to a temporary list of items that are considered potential duplicates. This list is used to build a set of related cases before assigning a primary case.

• Set Deduplicate Of: Assigns the current case as a duplicate of another case selected from the list previously built using Add Deduplicate Item. This action establishes a clear relationship between the duplicate case and the primary case, consolidating all relevant information under the primary case.

  Once the deduplication is applied, the relationship is displayed in the Duplication Info section of the case details view.

The Duplication Info section displays details about the deduplication relationship, including the primary case (Duplicate Of), first seen and last seen timestamps, duplication hash, duplication count, and whether the current case is marked as a duplicate or as the last duplicate.

For example, if Investigation - Repeated Authentication Failures refers to the same activity as Investigation - Suspicious Failed Logons, the analyst can add the repeated authentication case as a deduplication item and then set it as duplicate of the suspicious failed logons case.

Change User Classification

A case can be given a user classification, which is displayed in the Classification field of the case Overview tab. To set it, select Change User Classification from the menu of the case row, or from the Actions menu of the case details page. Choose a value in the User Classification field and save.

The available classification values are configured under Settings > User Classifications; the window contains a Configure classification options link to that page.

Create a New Case

The Case Management module allows users to create investigation records that group related alerts, evidence, notes, and user activity into a structured workflow. Each case acts as a central workspace for tracking investigation progress, assigning responsibilities, documenting findings, and maintaining a clear audit trail throughout the incident lifecycle.

To create a new case, click the button. This opens the Add Case window.

The following fields can be configured (fields marked with a red asterisk are mandatory):

• Name: Enter a clear and descriptive case title that reflects the issue being investigated. Using a consistent naming convention helps improve traceability and makes cases easier to identify later.

• Severity: Select the case severity: Critical, High, Medium (default), or Low. When the selected case type has no SLA of its own, the severity supplies the default SLA for the case. When a case is created from an alert, the severity is pre-filled from the alert security level.

• Owner (user): The user responsible for the case. It defaults to the current user.

• Collaborators: Select the users who will participate in the investigation or require access to the case. Collaborators can review case details, add notes, upload evidence, and contribute to the investigation process.

• Status: Select the current phase of the case from the dropdown menu:

  • New - The case has been created and is awaiting initial review or triage.
  • Open - The case is actively being investigated by the security team.
  • Solved - The issue has been resolved, but the case may still require final validation or documentation.
  • Closed - The case has been completed and no further action is required.
  • Archived - The case has been retained for historical, audit, or compliance purposes.

  It is recommended that each organization defines an internal procedure for when cases should move between statuses such as New, Open, Solved, Closed, and Archived.

• Case Types: Select the category that best describes the investigation. Case types help organize, filter, and analyze cases based on the nature of the incident. The SLA configured for the case type sets the response and confirmation deadlines of the case.

• Description: Provide a short explanation of the case context, including why the case was created, what activity is being investigated, and what the expected analysis should cover.

• Add evidence: Click Choose files to upload supporting files related to the case, such as logs, screenshots, exported alerts, reports, or other relevant investigation materials.

• Related alerts (optional): Search for and select alerts that belong to the investigation. Use the interval selector next to the search box (Last 24 hours, Last 7 days, Last 30 days, or Last 90 days) to choose how far back to look. The selected alerts are attached to the case as evidence when you save.

• Case Template: Select a predefined template to add its custom fields to the case. Templates are managed on the Case Templates page and help reduce manual effort when creating recurring or similar investigation cases.

Click Save to create the case, or Cancel to discard it and return to the case list.

Edit Case

To modify an existing case, click the button on the case row, or Edit on the case details page. The Edit Case window contains the same fields as the Add Case window. It also lists the Attached files of the case and allows adding new evidence files. After making the necessary changes, click Save to confirm or Cancel to discard them.

Add a Note

To add an investigation note, click the button on the case row, or Add Note on the case details page. Type the note text and click Save. The note appears in the Notes & Evidence tab and in the Timeline of the case.

Attach a Ticket

A case can be linked to a ticket in an external ticketing system directly from the case list, without leaving the Case Management module. This requires a ticketing provider to be configured under Settings → Ticketing.

To attach a ticket, click the button on the case row and select Attach ticket. The Case Tickets window opens with two modes:

• Create new - Creates a brand new ticket in the configured external ticketing system. The Summary and Description fields are pre-filled from the case name and description, and can be edited before the ticket is created.

  

• Link existing - Links the case to a ticket that already exists in the external system. The Existing ticket drop-down is populated live, by querying the configured provider for open tickets, so the list always reflects the current state of the external system rather than a cached snapshot.

  

Once a ticket is attached, it appears in the Attached tickets list with a link to open it directly in the external system. A ticket can be detached from the case at any time using the Unlink action next to it, without affecting the ticket in the external system.

Generate Reports

The Generate Reports feature allows users to export case information from the Case Management module for documentation, review, audit, or compliance purposes. The report covers the cases that match the current filters, status, and period of the case list. Reports are generated in HTML format and can include either a general case overview or a more detailed report based on selected case data tables.

To generate a report, click the button from the Case Management toolbar. This opens the Generate case report window, where you select the Report type.

The following report types are available:

• Summary Report - Generates a general overview of the cases available in Case Management. This report includes high-level statistics such as the total number of cases, closed cases, close time values, total investigation time, and generation details.

• Detailed Report - Allows the user to generate a customized case report by selecting specific tables from the available list. This option is useful when the report must include only certain categories of case information.

  When Detailed Report is selected, the Tables field becomes available. From this drop-down list, users can choose the information that should be included in the exported report.

  Available tables may include:

  • CasesTypes - Displays case distribution by case type.
  • UserCases - Displays the number of cases assigned to each user.
  • Status - Displays case count grouped by status.
  • EvidencesByCase - Displays the number of evidence items linked to each case.
  • EvidencesCount - Displays evidence count grouped by evidence type.
  • EvidencesStatistics - Displays evidence-related statistics, such as total, average, minimum, and maximum evidence count.

After selecting the report type and the required tables, click Save to generate the report. The exported HTML file can then be used for internal documentation, investigation review, management reporting, or audit evidence.

Associating Events/Alerts with a Case

Case Management is tightly integrated throughout key CYBERQUEST investigation modules, enabling seamless transition from threat identification to investigation. This integration allows security analysts to efficiently convert potential security incidents identified in other modules directly into managed cases. Wherever the Case Management action menu is available - typically accessible via an action arrow - items can be used as evidence by creating a new case or attaching them to an existing one.

Integration with Browser Module

The Browser module allows users to review, filter, and analyze security events in detail. When an analyst identifies an event that requires further investigation, the event can be used to create a new investigation case or can be added as evidence to an existing case.

To create or update an investigation case from the Browser module:

1. Navigate to the Browser module and locate the event that requires investigation.
2. Click the icon next to the selected event to open the event actions menu.
3. From the actions menu, select one of the following options:
   • Create Investigation Case - Opens a new case creation window and automatically adds the selected event as evidence for the new case.
   • Add to Existing Investigation - Allows the user to select an existing case and attach the selected event as evidence to that investigation.

Integration with Alerts Module

The Alerts module allows analysts to create or update investigation cases directly from detected alerts. When an alert requires further analysis, it can be converted into a new case or attached as evidence to an existing investigation.

To create or update a case from an alert:

1. Navigate to the Alerts module and locate the alert that requires investigation.

2. Click the button to expand the alert details.

3. From the expanded alert view, use one of the available investigation actions:

   • Create Investigation Case - Opens a new case creation window and automatically adds the selected alert as evidence for the new case.

   • Add to Existing Investigation - Adds the selected alert as evidence to an already existing case. This option is available from the alert actions menu by clicking the three-dot menu on the right side of the alert action bar.

   

   

Case Statistics

The Case Statistics page provides a graphical summary of case activity across the organization. Open it with the Case Statistics button at the top of the Case Management module, or at any time with the Cases Overview button in the left-side menu of the web interface.

This view helps users monitor case volume, investigation progress, overdue confirmations, overdue responses, user workload, and status distribution within a selected time range.

The top section displays the main case indicators:

1. Open Cases - Shows the total number of cases currently marked with the Open status, and the change compared with the previous period.

2. Response Overdue - Shows the number of cases where the configured response time has been exceeded.

3. Confirmation Overdue - Shows the number of cases where the configured confirmation time has been exceeded.

The date range selector allows users to filter the displayed information by predefined intervals: Today, Yesterday, Last Week, or Last Month. The selected interval is displayed next to the buttons and controls the data shown in the charts and summary panels. The By Severity row shows how many cases of each severity (Critical, High, Medium, Low) fall within the interval.

The dashboard includes the following sections:

4. Status Distribution - Displays the distribution of cases by status, such as New, Open, Solved, Closed, and Archived.

5. Case Statuses - Shows how case statuses evolved over the selected time interval.

6. Period Comparison - Compares case status values between the current and previous selected periods.

7. Latest Cases - Displays the most recently modified cases, including case name, owner, status, and confirmation/response state.

8. Overdue Confirmations - Lists cases where the confirmation time has been exceeded.

9. Overdue Responses - Lists cases where the response time has been exceeded.

10. Top Users - Displays the users associated with the highest number of cases, helping identify workload distribution across analysts or teams.

To export the data of a section in CSV format, click its button.

SLA and Case Escalation

Click SLA at the top of the Case Management module to open the Service Level Agreements page. This page lists the configured SLAs, with summary cards for the total number of SLAs, the number of case types covered, and the average response time. Click Add Service Level Agreement to create an SLA. Creating and managing SLAs is described in Service Level Agreement (SLA) Management.

The Enable case escalation option at the top of the page turns case escalation on or off. When it is enabled, cases can be escalated manually from the Case escalation section of the case Overview tab, and automatically when the SLA interval of a case expires. A case is only escalated if it has a case level assigned; cases without a level are skipped. Escalation moves the case to the next level configured on the Case Levels page.

Case Levels

Click Case Levels at the top of the Case Management module to define the responsibility levels used for escalation, for example a first-line and a second-line analyst team. Each level points to the next level a case is escalated to. When a case is escalated, it is assigned to the eligible member of the next level who has the fewest active cases.

The list shows the Name, Description, Next Level, Eligible Users, and Status of each level, and the Edit button in the Actions column opens a level for editing. Use the search box to find a level by name.

To create a level, click Add case level and fill in the following fields:

• Name - The name of the level.
• Description - A short description of the responsibilities of the level.
• Next level - The level a case is escalated to from this level. Leave it empty for the last level.
• Eligible users - The users who can receive cases escalated to this level. A level can be saved without members, but escalation to it is blocked until a recipient is available.
• Active - Only active levels can be selected for a case.

Click Save case level to create the level.

Case Templates

Click Case Templates at the top of the Case Management module to manage case templates. A case template is a reusable set of custom fields that is added to a case when the template is selected in the Case Template field of the Add Case window. Templates help standardize the information collected for recurring types of investigation.

The page displays the existing templates in a grid or list view. Use the search box to find a template, and the sort selector to order templates by Name, Last Modified, or Fields Count.

To create a template, click Add Template, enter the template Name, then add its fields. Select the field type in the drop-down next to Add Field and click Add Field. The available field types are Text, Select, Boolean, Number (decimal), Email address, URL, IP address, Domain, Hash (MD5 / SHA-1 / SHA-256 / SHA-512), and Date and time.

For each field, configure:

• Name - The label of the field.
• Type - The field type.
• Initial Value - An optional default value.
• Autofill - An optional event field whose value is used to fill in the field automatically.

Click the Optional / Required badge in the field header to mark the field as mandatory or optional. Drag a field by its handle to change the order of the fields. Click Save to create the template.

DORA Journey

Click DORA Journey at the top of the Case Management module to track compliance with the requirements of the Digital Operational Resilience Act (DORA). The summary cards show the total number of requirements, how many are completed and pending, and the number of attached documents. The progress bar shows the overall completion percentage.

The table lists the DORA requirements by Chapter and Article. For each requirement:

1. Click Upload to attach a document that proves the requirement is met. Accepted formats are PDF, DOCX, XLSX, PNG, JPG, and TXT, up to 20 MB. The attached documents are listed in the Attached Docs column.
2. Select the All Requirements Met? checkbox to mark the requirement as completed. The checkbox becomes available only after a document has been uploaded, because a requirement is marked as met on evidence.

Use the Search by tag box to filter the requirements. Click Internal Security Documents to open the repository of internal security documents that can serve as evidence.

CYBERQUEST - DORA Regulatory Assistance Module

The DORA Regulatory Assistance module extends the CYBERQUEST Case Management workflow with dedicated support for incident handling and regulatory reporting under the Digital Operational Resilience Act (DORA).

The module helps security teams document, classify, and report ICT-related incidents in a structured and traceable manner. It supports the creation of regulatory reports based on the reporting structure defined by DORA and the related EU implementing regulation: EUR-lex

The DORA module enhances the Case Management environment with dedicated regulatory assistance features:

• DORA Journey - Provides a dedicated interface for following DORA-related compliance and readiness activities. It helps organizations track progress, identify gaps, and organize the steps required to support operational resilience and regulatory alignment.

• Incident Reporting - Allows users to generate structured incident reports directly from a case. Depending on the reporting stage, users can initialize report types such as Initial Report, Intermediate Report, Final Report, or Major Incident Reclassified as Non-Major.

• Standardized Report Structure - Helps ensure that incident reports follow a consistent format aligned with DORA reporting expectations. This reduces manual effort and supports more reliable documentation during incident response.

• Case-Based Evidence Collection - Links regulatory reporting with investigation data already available in the case, including alerts, evidence, notes, timelines, status changes, and assigned users.

• Incident Classification Support - Enables analysts to classify incidents according to the selected regulatory context, helping determine whether an event requires formal reporting or internal handling.

By integrating DORA reporting into the investigation workflow, CYBERQUEST helps organizations move from detection and case management to structured regulatory documentation, reducing reporting effort and improving audit readiness.

CYBERQUEST - NIS2 Regulatory Assistance Module

The NIS2 Regulatory Assistance module extends the CYBERQUEST Case Management workflow with dedicated support for incident documentation and reporting under the NIS2 Directive. NIS2 aims to establish a high common level of cybersecurity across the European Union and introduces cybersecurity risk-management and reporting requirements for essential and important entities.

The NIS2 module helps security teams manage significant incidents in a structured and traceable way, directly from an investigation case. Users can select the NIS2 reporting option, choose the relevant incident category, and initialize the appropriate report type.

The available NIS2 report types include:

• Initial Report - Used to create the first incident report when a significant incident is identified and requires formal documentation.
• Intermediate Report - Used to provide updated information as the investigation progresses or when additional findings become available.
• Final Report - Used to document the completed investigation, including impact, root cause, actions taken, and final conclusions.
• Significant Incident Reclassified as Non-Significant - Used when an incident initially considered significant is later reassessed and no longer meets the reporting criteria.

The NIS2 module enhances the Case Management environment with dedicated regulatory assistance features:

• Incident Reporting - Allows users to generate structured reports directly from a case, keeping the investigation context linked to the reporting process.
• Case-Based Evidence Collection - Uses case information, evidence, notes, timelines, and related alerts to support incident documentation.
• Standardized Report Structure - Helps ensure that NIS2 incident reports follow a consistent format, reducing manual effort and supporting audit readiness.
• Incident Classification Support - Helps analysts classify and manage incidents according to the selected NIS2 reporting context.

By integrating NIS2 reporting into the case workflow, CYBERQUEST helps organizations connect security operations with regulatory documentation, making incident handling more consistent, traceable, and easier to review.