Viewing and Editing Case Details

From the Case Management table, you can view the following information on any Case:

• Case Details - This includes tracking the Case progress, and viewing, modifying, or adding to its configuration.
• Case Assets - The assets on which the Case was opened.

Viewing Case Details

In the Case drawer of a selected Case, the Case Details tab enables you to:

• Track the Case progress.
• View the Case details.
• Pivot to the assets resulting from the Base query at the time of Case creation.
• Pivot to the list of resolved assets or unresolved assets.
• Pivot to the assets resulting from any Additional query.
• Pivot to the configuration of any Enforcement Set linked to the Case and view its main Enforcement Action.

To view Case details

1. In the Case Management page, click a Case. The Case drawer - Case Details tab opens.
   

2. In the Case progress section, you can see the progress of the Case, refresh the progress calculation, and pivot to the initial list of Case assets, resolved assets, or unresolved assets. See below how to track Case progress.

3. View the Case information that you set when creating or editing the Case, including Due Date, Status, Priority, Created On, Case Title, Description, Type, Assignee, Base Query, Additional Queries, and Enforcements Links. An explanation of these fields is provided in Creating a New Case.

   • The number of days until the Due Date is displayed in color next to the date, only if it is coming up in 1-10 days or is Overdue.

   • For Cases created using the Create a new case enforcement action, the following notification appears under Base Query: This case was created on assets from Enforcement Center action with this query <query name link>. For example:

     

4. To see the assets resulting from the base query, under Base Query, click the base query. The Assets page opens in a new tab. Click the Queries tab. The following screen shows an example of Users resulting from the unclear admin status query.
   

:::(Internal) (Private notes)Used to open the Assets page - Queries tab. It now opens the Assets page - Assets tab. You can then open the Queries tab.
:::
5. To see the assets resulting from an additional query, under Additional Queries, click a query. The Assets page opens in a new tab, displaying the assets resulting from the selected query.

7. To view the configuration of an Enforcement Set linked to the Case, under Enforcements Links, click the Enforcement Set name. The Enforcement Set configuration page opens. Learn more about the Enforcement Set fields. Note that you can hover over the icon on the Enforcement Set row to view its main Enforcement Action.
   

Tracking Case Progress

The top of the Case drawer shows the Case progress (also displayed in the Case Management table under the Case Progress column).
The system automatically calculates the Case progress by dividing the number of resolved assets by the number of assets returned from the initial query, and then multiplying that result by 100 to get a percentage. For example, if there are 200 assets returned by a query that is linked to a case and 20 of those assets become resolved, the progress is 20/200 = 0.1 = 10%.

• Progress results are updated automatically once every six hours or every Discovery Cycle. You can recalculate Case progress at an earlier time, by clicking the Refresh icon
  • Click the View Query Results link to pivot to the list of assets that were returned by the Base query on the date of Case creation. This initial list of assets is compared to resolved assets in order to determine the progress of the Case.

* The green portion of the Progress bar shows the percentage of resolved assets.

* The gray portion of the Progress bar shows the percentage of unresolved assets.

Editing Case Details

In the Case drawer of any Case, you can modify the configuration of the Case. You cannot modify the Created On date or the Base Query.

To edit Case information

1. In the Case Management page, click a Case. The Case drawer opens (see screen in Viewing Case Details above).

2. Modify any of the following fields, as required:

   • Due Date - Click the x near the date to remove it and then click Select Date to open the calendar, or click the current date to open the calendar. Then, from the calendar, select a new date, and optionally a new time, and click Ok. The badge changes accordingly or is removed if the new date is more than 10 days away.

   • Status, Priority, Type - Hover over the field value, click it to open its dropdown list, and then select a new value. Learn more about Case status and using an action to change it.

   • Case Title, Description - Hover over the field value, and when a blue frame encloses the field value, click inside the field and type or overtype a new value.

   • Assignee - Hover over the field value, click it to open its dropdown list, and then select or replace an assignee. Or, click the trashcan icon to delete the assignee. You can choose one later on.

   • Additional Queries, Enforcements Links - To modify, add, or remove an Additional Query / Enforcement Set, hover over the Additional Queries / Enforcement Links title and click the Pencil icon that appears. Replace a Query / Enforcement Set by choosing a different one from the dropdown, remove a Query / Enforcement Set link by clicking the adjacent Trashcan icon, or add a new one by clicking the + icon for each one that you want to add.

3. After making an edit to at least one field in the Case drawer, the Cancel and Save buttons appear on the bottom of the Case drawer. After making changes, you can do either of the following:

   • Click Save to save all your changes to the Case information. The Case drawer closes and the Case Management page is updated with the changes to the edited Case's information.

   • Click Cancel to erase all your changes. The Case drawer closes and the Case Management page opens with no change to the Case information displayed.

Viewing Case Assets

In the Case Assets tab of the Case drawer, you can view a listing of assets for which the Case was opened and pivot to the Assets page to view detailed information on these assets.

To view Case assets

1. In the Case Management page, click a Case.
2. In the Case drawer that opens, click the Case Assets tab. The Case Assets page opens, with the Case assets listed under the tab of the main Asset Type.
   

• In the Case Assets drawer, the table displays the list of assets (the maximum number that fits in the drawer) on which the Case was created, with the following fields:
  • Adapter Connections - The icons of the adapter connections. Click the arrow at the start of the Asset row to open a row per adapter connection.
  • The field in the column after the Adapter Connections column in the Assets page default view. Each Asset Type has its own default view, and the first field after Adapter Connections varies. For example, for Device assets, it is Asset Name; for Users, it is User Name; for Vulnerability assets, it is Vuln ID, and so on.
• Total (above the table) displays the number of assets resulting from the Base query configured in the Case. If there are more results than can be shown in the drawer, hovering over the info icon displays the tooltip: Showing partial results in drawer.
• Total Tickets (above the table) shows the number of tickets opened for Case assets. Currently not relevant.

• Click the Open in Asset Page link to pivot to the Assets page, listing the complete list of Case assets (with all fields). See the documentation of the relevant Assets page for a description of the fields in the table.

Viewing Case Assets on Assets Page

From the Case Assets tab in the Case drawer, click the Open in Asset Page link to pivot to the Assets page showing the list of assets related to the Case. The Assets page opens, listing the complete list of assets related to the Case. You can click the Refresh icon near the Last updated date and time to show the updated list of assets. See what you can do on an Assets page.