Viewing and Editing Case Details

From the Case Management table, you can open any Case to view its progress, as well as view, modify, or add to its configuration.

Viewing Case Details

From the Case drawer of a selected Case, you can do the following:

• Track the Case progress.
• View the Case details.
• Pivot to the assets resulting from the Base query at the time of Case creation.
• Pivot to the list of resolved assets or unresolved assets.
• Pivot to the assets resulting from any Additional query.
• Pivot to the configuration of any Enforcement Set linked to the Case and view its main Enforcement Action.

To view Case details

1. In the Case Management page, click a Case. The Case drawer opens.
   

2. In the Case progress section, you can see the progress of the Case, refresh the progress calculation, and pivot to the initial list of Case assets, resolved assets, or unresolved assets. See below how to track Case progress.

3. View the Case information that you set when creating or editing the Case, including Due Date, Status, Priority, Created On, Case Title, Description, Type, Assignee, Base Query, Additional Queries, and Enforcements Links. An explanation of these fields is provided in Creating a New Case.

   • The number of days until the Due Date is displayed in color next to the date, only if it is coming up in 1-10 days or is Overdue.

   • For Cases created using the Create a new case enforcement action, the following notification appears under Base Query: This case was created on assets from Enforcement Center action with this query <query name link>. For example:

     

4. To see the assets resulting from the base query, under Base Query, click the base query. The Assets page - Queries opens in a new tab. The following screen shows an example of Users resulting from the unclear admin status query.
   

5. To see the assets resulting from an additional query, under Additional Queries, click a query. The Assets page - Queries opens in a new tab, displaying the assets resulting from the selected query.

6. To view the configuration of an Enforcement Set linked to the Case, under Enforcements Links, click the Enforcement Set name. The Enforcement Set configuration page opens. Learn more about the Enforcement Set fields. Note that you can hover over the icon on the Enforcement Set row to view its main Enforcement Action.
   

Tracking Case Progress

The top of the Case drawer shows the Case progress (also displayed in the Case Management table under the Case Progress column).
The system automatically calculates the Case progress by dividing the number of resolved assets by the number of assets returned from the initial query, and then multiplying that result by 100 to get a percentage. For example, if there are 200 assets returned by a query that is linked to a case and 20 of those assets become resolved, the progress is 20/200 = 0.1 = 10%.

• Progress results are updated automatically once every six hours or every Discovery Cycle. You can recalculate Case progress at an earlier time, by clicking the Refresh icon
  • Click the View Query Results link to pivot (in a new tab) to the list of assets that were returned by the Base query on the date of Case creation. This initial list of assets is compared to resolved assets in order to determine the progress of the Case.
  • The green portion of the Progress bar shows the percentage of resolved assets. Clicking it pivots to the list of resolved assets - those assets that were in the initial query, but have since been resolved, and therefore are no longer returned by the query.
  • The gray portion of the Progress bar shows the percentage of unresolved assets. Clicking it pivots to the list of unresolved assets - those assets that remain from the initial query.

Editing Case Details

In the Case drawer of any Case, you can modify the configuration of the Case. You cannot modify the Created On date or the Base Query.

To edit Case information

1. In the Case Management page, click a Case. The Case drawer opens (see screen in Viewing Case Details above).

2. Modify any of the following fields, as required:

   • Due Date - Click the x near the date to remove it and then click Select Date to open the calendar, or click the current date to open the calendar. Then, from the calendar, select a new date, and optionally a new time, and click Ok. The badge changes accordingly or is removed if the new date is more than 10 days away.

   • Status, Priority, Type - Hover over the field value, click it to open its dropdown list, and then select a new value. Learn more about Case status and using an action to change it.

   • Case Title, Description - Hover over the field value, and when a blue frame encloses the field value, click inside the field and type or overtype a new value.

   • Assignee - Hover over the field value, click it to open its dropdown list, and then select or replace an assignee. Or, click the trashcan icon to delete the assignee. You can choose one later on.

   • Additional Queries, Enforcements Links - To modify, add, or remove an Additional Query / Enforcement Set, hover over the Additional Queries / Enforcement Links title and click the Pencil icon that appears. Replace a Query / Enforcement Set by choosing a different one from the dropdown, remove a Query / Enforcement Set link by clicking the adjacent Trashcan icon, or add a new one by clicking the + icon for each one that you want to add.

3. After making an edit to at least one field in the Case drawer, the Cancel and Save buttons appear on the bottom of the Case drawer. After making changes, you can do either of the following:

   • Click Save to save all your changes to the Case information. The Case drawer closes and the Case Management page is updated with the changes to the edited Case's information.

   • Click Cancel to erase all your changes. The Case drawer closes and the Case Management page opens with no change to the Case information displayed.