Explore the case queue header

Supported in:

Google secops SOAR

The case queue header provides quick access to key actions and display options for managing and reviewing cases. Use the controls in the header to customize your view, apply filters, and take bulk or individual actions on selected cases.

Navigate the case queue header

This section describes the available options on the case queue header.

Sort cases

You can sort cases in the queue based on various criteria to help with organization and prioritization. Available options include the following:

• By ID: High to Low / Low to High
• By Time Created: Newest to Oldest / Oldest to Newest
• By Modified: Newest to Oldest / Oldest to Newest
• By Playbook Status: Success to Failure / Failure to Success
• By Priority: High to Low / Low to High
• By SLA: Longest to Shortest / Shortest to Longest

Switch between side-by-side view and list view

Analysts can choose to see cases in either the side-by-side view (default when you open the Cases page) or the List view.

• To switch between the side-by-side view and list view, click Cases view selection.

The List view displays all open cases in a single space, which facilitates triage, sorting, filtering, customization, and updating case information.

You can also do the following with the List view:

• Manage columns: Click view_column Manage columns to hide or display specific columns.
• Clickable Case ID: Click a case ID to open a specific case.

Both views support the following actions:

• Apply Filters: Narrow your case search. Filters applied in one view also apply in the other. For more information about filters, see Apply and save filters.
• Create a manual case/simulate cases: Click add Add to Create a manual case or Simulate cases.
• Merge cases: For details about how to merge cases, see Merge Cases.
• Close cases: For details about how to close a case, see How to close cases.

Switch to Compact view

You can switch to a Compact view to display essential information like playbooks, their status, alerts count, and assigned roles. This view is useful for a quick glance at cases in the queue.

To switch to Compact view, click sync_alt Switch to Compact view.

Merge cases

You can merge cases directly from the case queue (from both the side-by-side view and the List view). This lets you review and consolidate the case information and determine which cases should be merged.

Merge cases from the side-by-side view

To merge cases from the Side-by-side view, follow these steps:

1. Click Multiple Selection.
2. Select the required cases in the case queue.
3. Click menu Menu.
4. Click Merge Cases.
5. In the Merge Cases dialog, select the parent case that contains the merged cases.
6. Click Merge.

Merge cases from the List view

To merge cases from the List view, follow these steps:

1. Click Merge cases.
2. In the Merge Cases dialog, select the parent case that contains the merged cases.
3. Click Merge.

Need more help? Get answers from Community members and Google SecOps professionals.