Mark a Case as an Incident

Supported in:

Google SecOps SOAR

1. In the Cases page, drill down to the required case.
2. Click format_list_bulleted Case Actions on the top right of the page and select Incident from the menu.
   

   

3. Click Yes in the confirmation dialog box. The page refreshes and the new Incident now appears with the Incident icon in the cases list marked with the red critical sidebar. In addition, the case is automatically assigned to SOC Manager user or the user with SOC Manager role.