Creating a New Case

You can create a new Case, in order to track, monitor, and remediate similar assets in the system, using either of the following methods:

• From the Case Management page, manually create a one-time Case to run on assets returned from a defined query at the time the Case is created. In this method, you click Create Case to open a Case drawer, configure the Case, and create it. This method includes the option to send an external notification informing that a Case has been created.
• From the Enforcement Center, automate Case creation by configuring a new Case using the Create new case enforcement action. When run, this Enforcement Set automatically creates a new Case on the Enforcement Set query (equivalent to the Base query in the first method) each Discovery Cycle or according to another defined schedule. Each created Case runs on assets resulting from the query that runs at the time that the Case is created, which usually changes over time as assets are added and removed from the system. There is also an option (recommended) to run the Enforcement Set on added assets only, i.e., create a Case that runs on the delta of Query results since the previous Enforcement Set run. This is recommended and avoids processing the same assets multiple times. In this method, you can add an enforcement action from the Notify category to send an external notification informing that a Case has been created.

This section describes the first method of creating a one-time Case from the Case Management page.

Creating a Case from the Case Management Page

For each new Case that you create, you are required to give the Case a name, select the type of issue, and link it to an asset query (Base Query). Optionally, you can also set the following for the Case:

• Set the priority of the Case, assign the Case to a relevant user, set a due date for resolving the Case, and more.
• Link additional Queries and/or Enforcement Sets to the Case, in the same way that you would link data to a Jira or Zendesk ticket.
• Notify assignees or others via email about the new Case.

When you save a newly created Case, a list of assets currently matching the query is also saved. From then on, Case Progress is calculated based on assets that leave the query due to their being reconciled/remediated. You can manage the new Case together with already existing Cases from the Case Management page, and open the configuration of any Case to track its progress and change its status or any other field (except the Base Query). When all initial assets (with the exception of assets that may be removed from the system over the course of time) are remediated, you can close a Case.

To create a new Case

1. In the Case Management page, click Create Case. The Create Case drawer opens.

2. Configure the required fields and any of the optional fields, as follows:

   • Case Title (Required) - Type a name for the Case. Recommended that it should be a meaningful name.

   • Click + Add Description, and in the Description field that opens, type a short description of the Case.

   • Type (Required) - From the alphabetically ordered dropdown list, select the case type that best describes the issue: Application missing/installation, Data Breach Remediation, Groups Synchronization/Migration, IT - General, Other Cases, Reduce Attack Surface, Security - General, Upgrades, Vulnerability Remediation.

   • Priority (Default: P0) - From the dropdown, select the priority of the case, i.e., the urgency of the case. Available priorities: P0 (highest priority), P1, P2, P3, or P4 (lowest priority).
     

   • Status (Default: To Do) - From the dropdown, select one of the following priorities: To Do, Backlog, In Progress, Done.
     

   • Due Date - Click the calendar icon to open a calendar from which to select the date and time (optional) that the case is due, and then click Ok.

   • Assignee - From the dropdown, select one user only to take care of the case. The dropdown list shows users only from your data scope. Clicking the adjacent trashcan icon clears the selected assignee.

     • You can postpone assigning a Case to a user to some time after Case creation.

   • Base Query (Required) - Select the query that you want the Case to monitor.

     • From the Module dropdown, select an asset type, and from the Select Query dropdown, select an existing query for the selected asset type, or click + Add Query to create a new query. To learn more about creating a new query, see Creating a New Query.
     • The Base Query can only be an asset query; not an internal module query, such as Adapters Fetch History.
     • You can hover over the selected Query and then click the View or Edit Query icon to verify the query or if necessary, edit the Query.

     

     The following screen shows the unclear admin status query drawer.
     

   • Additional Queries - Select one or more optional queries to link to the Case.

     • From the Module dropdown, select an asset type, and from the Select Query dropdown, select an existing query for the selected asset type, or click + Add Query to create a new query. To learn more about creating a new query, see Creating a New Query.
     • Click the + button to select an additional query. The Case does not track these queries. Clicking the adjacent trashcan icon deletes the added query.
     • You can hover over the selected Additional Query and then click the View or Edit Query icon to verify or edit the query (similar to Base Query above).

   • Linked Enforcement - From the Select Enforcement dropdown, select one or more Enforcement Sets to link to the Case. Click the + button to select each additional Enforcement Set to link. Clicking the adjacent trashcan icon clears the selected Enforcement Set.

   • Set Email Notification (Default: Disabled) - You can set email notifications only if email settings are configured under System Settings. Toggle on to send an email notifying about the new Case.

     • Email Recipients - Type one or more email recipients, clicking Add for each additional recipient. It is recommended that at least one of these recipients should be the Assignee.
     • Custom Message - Type text to be added to the body of the email.

3. Click Create. The Case is added to the Case Management table.
   If you toggled on Set Email Notification (see above), all email recipients specified receive an email in the following format: A new Axonius case has been assigned to you followed by a link to the new Case and the custom message.