Triages reported phishing emails from the Phishing Triage use case
Triages alerts from the EDR, XDR, or SIEM Alert Triage use case
Summarizes alert data
Views, interacts with, enriches, and adds observables via the Threat Intelligence extension
Documents research and notes regarding an investigation
Provides investigation details and knowledge base articles
Collects granular metrics such as MTTR, MTTD, and dwell time
Identifies MITRE ATT&CK Phases
Works an investigation through its entire lifecycle, from signal ingestion through case and incident escalations, remediation, and resolution
Included as part of the SOC Foundations Bundle

Case and Incident Management