Working with Cases

The Cases view lets you manage cases generated by Stellar Cyber. A case is a set of multiple correlated alerts and entities constituting a potential unified security attack, ranked by a dynamically updated score indicating the severity of the attack. Stellar Cyber uses its machine-learning capabilities to generate cases automatically, grouping related alerts into a unified case for improved attack resolution. In addition, you can also create your own cases from any table that includes alerts (for example, Threat Hunting or Dashboards | PREDEFINED | Analyst View).

Cases offer the following benefits:

• Streamlined workflows matching standard security analyst procedures.

• Enact case-specific responses recommended by Stellar Cyber (for example, blocking an IP address) directly within the Case interface.

• Evidence Locker lets you store emails, PDFs, CSV files, and links to bolster your case.

• Full export capabilities let you share cases with executive staff.

• Case Activity log tracks all events related to a case, providing a detailed audit trail.

• Optional integration with ServiceNow lets you use Stellar Cyber cases and alerts together with your existing help desk and ticket management solution.

Cases evolve in real time as new alerts are discovered and associated with an attack, either automatically by machine learning or manually by a user. You can use Cases as part of your standard SOC workflows to direct a proactive response to ongoing security issues, ensuring they are assessed, assigned, tracked, and resolved.

This article covers the following subjects pertaining to cases in Stellar Cyber:

• Introducing the Cases Display

  • Using the Case Dashboard

  • InSync Indicators in the Cases Page

• Using the Current Cases Table

  • Working with the Current Cases Table

  • Filtering the Display of Cases

  • Searching the Current Cases Table

  • Performing Bulk Actions in the Current Cases Table

  • Standard Functionality in the Current Cases Table

• Changing Case Settings

  • Working with Cases

  • Working with Cases

  • Setting Case Properties

  • Setting the Correlation Timeout

  • Using Case Filters

• Drilling to the Case Detail Page

• Displaying Cases from Event Details

• About Case Data Retention

Refer to Understanding Cases for a detailed discussion of how cases are created and correlated.

Introducing the Cases Display

The Cases display consists of the following main components:

• Case Dashboard – The Case Dashboard is at the top of the Cases display and includes high-level charts that help you understand the overarching status of all cases passing the current filters.

• Current Cases Table – The Current Cases table is below the Case Dashboard and provides a sortable table of all cases passing the current display filters with customizable columns. You can select any case to drill to its detail page. You can also use the filters at the left of the page to focus your work on cases that meet specified criteria.

• Active InSyncs – Active InSyncs appear as separate icons above the Case Dashboard, as illustrated below. An InSync is an "integration synchronization" between Stellar Cyber and a third-party help desk or ticket management system, such as ServiceNow. InSyncs provide bidirectional exchange of alerts and cases between Stellar Cyber and the third-party application.

  InSyncs are not available for all customers yet. See Early Access Program Features and Topics Under Development.

The figure below illustrates the organization of the Cases Display:

Using the Current Cases Table

Cases are initially shown in a sortable table with customizable columns. You can select any case to drill to its detail page. You can also use the filters at the left of the page to focus your work on cases that meet specified criteria.

The tabular view lists each case on its own row with the following default columns:

• Tenant – The tenant with which this case is associated.

• Case ID – The system-assigned number for the case.

• Case Name – Stellar Cyber automatically assigns a name to each case it reports. You can either accept the default name or supply your own in the Case Detail view.

• Score – Stellar Cyber assigns scores to cases based on how critical they are. A case's score updates in real time as events and entities are added to or removed from the case. Scores are color-coded to indicate the seriousness of the case.

• Severity – The severity of the case (Critical, High, Medium, or Low). Severity automatically changes with a case's score until it is changed manually in the Case Detail view. Once you manually edit a case's severity, it no longer updates automatically based on the case score. Severity indicators are color-coded to direct your attention to more serious cases.

• Creator – The user account that created the case. Cases created by Stellar Cyber are listed with a creator of System.

• What – The Tactic or Technique for the alert with the highest severity associated with this case.

• Who – The users and hosts associated with the case. You can find details on the observables for the case in the Analysis tab on the Case Detail page.

• Assignee – The assignee for the case, if any. Cases can be assigned to resources in the Case Detail view or by selecting the check box for a case at the left of the table and using the bulk edit controls that appear at the top of the table.

Working with the Current Cases Table

The Current Cases table supports standard Stellar Cyber table functionality. You can change the columns in the Current Cases table by selecting the vertical Columns button at the left of the table to toggle open a panel where you can choose the columns to display.

You can add any of the following additional columns:

• Acknowledged At – The time at which the case was acknowledged. A case is considered acknowledged when a user makes a change to its Severity, Status, or Assignment.

• Size – The number of alerts associated with the case.

  A case can have a maximum of 5,000 associated alerts.

• Closed At – The time at which the case was closed. Cases are closed when their status is set to either Resolved or Cancelled.

• Created At – The time at which the case was created.

• InSyncs – For cases that are synchronized with an associated ServiceNow installation using an InSync, you can hover over mouse over the NOW icon in the InSyncs column and see the following information on the synchronization for the case:

  • The name of the InSync performing the synchronization between Stellar Cyber and a third-party application such as ServiceNow.

  • The status of the InSync (Synced, Paused, or Error).

  • The ticket number for the synchronized case in ServiceNow.

  • The last time the case was synchronized, expressed in the time zone of the browser.

  

• Last Modified – The last time the case was modified. A case is considered to have been modified whenever there are changes to its alerts, severity, status, comments, or evidence.

• Modified By – The user account that last modified the case.

• Status – The status associated with this case. This can be either New, In Progress, Resolved, Cancelled, or Escalated. Changing the status of a case helps you track your team's response to it over time. You can change a the status in the Case Detail view or by selecting the check box for a case at the left of the table and using the bulk edit controls that appear at the top of the table.

• Tags – The tags assigned to the case, if any. You can assign tags to a case in the Case Detail view or by selecting the check box for a case at the left of the table and using the bulk edit controls that appear at the top of the table.

• Resolution – The resolution given to a case when its status was set to Resolved. Resolutions can be None, False Positive, Benign, or True Positive. The default is None. See Suggested Usage for the Case Resolution Tags for more information on the available resolution tags.

Not All Columns Supported for Sorting

Filtering the Display of Cases

The Cases page includes a Filters panel that lets you focus the display on just those cases matching the criteria you supply. By default, you can filter the Cases page by Score, Severity, Assignee, Created At date, Last Modified date, Status, or Tags. You can also use the Add new filter feature to add filters based on the same criteria available as columns for the Current Cases table.

The Filters panel indicates which filters are currently applied with a special icon in the entry for each filter type. For example, in the figure above, we can see that there is currently a Created At filter applied. Similarly, when the Filters panel is cascaded closed, its entry updates to show the total filters applied, as in the example below.

Use the following filters to control the information that's displayed:

• Score – Use the slider bar to specify the range of case scores from 0-100 to display.

• Severity – Check one or more of the boxes for the case priorities to display (Critical, High, Medium, and Low).

• Assignee – Start typing in the Search field to see a list of matching user accounts that can be selected as a filter or choose one of the listed users. Users only appear for selection if they have the Edit Cases privilege assigned in Role-Based Access Control and belong to the logged-in tenant. You can select multiple users for the filter.

• Created At – Use the date controls to specify a range for the creation dates of the cases to display.

  By default, the Created At filter is automatically set to the last 24 hours. If you select Clear All, the Created At filter resets to the last 24 hours. You can set a range manually if you need a larger range.

• Last Modified – Use the date controls to specify a range for the modification dates of the cases to display. Modifications include changes to the alerts, severity, status, comments, or evidence of a case.

  The dates you specify for both the Created and Last Modified filters are specified in terms of the browser's local time zone.

• Status – Select one or more case statuses to display: Escalated, New, In Progress, Resolved, and Cancelled.

  By default, the Cases page has the Escalated, New, and In Progress Status filters enabled. You can deselect these filters and/or add additional Status filters. However, if you clear all the Status filters, the page automatically enables the default Escalated, New, and In Progress filters again.

• Tags – Start typing in the Search field to see a list of matching tags that can be selected as a filter or choose one of the listed tags. You can select multiple tags for the filter.

Searching the Current Cases Table

The Current Cases table includes a Search tool at the top of the display that lets you perform a text-based search using Lucene syntax for a specified value. Keep in mind the following when searching Cases:

• The data returned by the search is limited to just those entries that pass the current Case filters.

• The search is performed across all available pages of cases, not just the currently displayed page. For example, if there are three pages of 20 cases available in the Current Cases table, matches can be found on any of the three available pages, regardless of the sort order.

Not All Fields Supported for Searching

Performing Bulk Actions in the Current Cases Table

The Current Cases table supports bulk edits to the Status, Tags, or Assignee of multiple cases. Use the following procedure:

1. Select one or more cases in the Current Cases table by checking their boxes at the left of the table.

   New Bulk Edit controls appear at the top of the table, as illustrated below:

   

2. Select the type of Bulk Action want to perform from the dropdown:

   • Status – The adjacent dropdown lets you select any of the standard Case statuses (Escalated, New, In Progress, Resolved, or Cancelled).

     Once the status of a case has been changed to either Resolved or Cancelled, Stellar Cyber no longer associates new alerts with it. Instead, new alerts are either used to create a new case or associated with a different open case.

   • Tags – The adjacent dropdown lets you select from any existing tags. You can also type in a new tag.

   • Assignee – The adjacent dropdown lets you select any existing user available to your tenancy.

3. Select Apply to apply your bulk action to the selected cases.

Keeping Track of Bulk Actions

Once you apply a bulk action to one or more cases, Stellar Cyber displays a success or failure message at the top of the display and keeps track of its progress in the Task List.

Here's an example of a Bulk Action that was successfully applied:

You can display the Task List using its icon at the top of the display, as illustrated below. The Task List keeps track of the progress, success, or failure of any bulk actions performed from the Current Cases table, as well as any other ongoing Stellar Cyber activities. Depending on the number of cases affected by a bulk action, it make take a few seconds for the action to complete. The Task List is useful in these situations, letting you see the progress of the action. Here's how you display the Task List, complete with some successful bulk actions:

You can clear individual tasks from the list using the standard close button at the upper right of their entries in the list. Clear all of the tasks using the Clear all link at the top of the list.

Standard Functionality in the Current Cases Table

The Current Cases Table offers standard table functionality, including the ability to sort on a column, pin columns, autosize columns, reset column sizes, Export as CSV, or Change Columns.

Changing Case Settings

Users with a root user scope and RBAC privileges to change user interface settings can select the Settings icon at the upper right of the Cases page and make global changes that affect all cases. Case Settings include options for controlling visibility (Case Properties), case alert correlation behavior (Correlation), and case suppression logic (Case Filters).

Refer to Understanding Cases for a detailed discussion of how cases are created and correlated.

Using Case Filters

You can use case filters to control the automatic creation of cases by defining specific conditions under which Stellar Cyber suppresses their creation. Instead of generating a case for every group of related alerts, you can use case filters to prevent the creation of cases that are low risk, expected, or otherwise unimportant. This reduces case volume and helps you focus attention and resources on the alerts that matter most. This targeted suppression allows your team to maintain a streamlined, relevant case queue and reduce alert fatigue.

In the Case Settings section, you can create new filters, edit existing ones, or delete filters that are no longer needed. For detailed information about case filters, see Using Case Filters and the Filter Builder.

Drilling to the Case Detail Page

You can select a case entry in the Current Cases table to drill to the Case Detail view for the corresponding Case.

Displaying Cases from Event Details

In addition to accessing the Current Cases table from the Cases menu, you can also display a filtered Current Cases table from the Cases list in the Event Details view for an alert.

The Cases list shows cases associated with the selected alert in descending order by score, up to a maximum of five. You can select the View All (x) link at the upper right of the list to open a new tab with a filtered view of the Case summary page showing just those cases associated with the selected alert. You can also select the entry for an individual case in the list to open its associated Case details page. The figure below shows the Cases list from the Event Details view of an alert:

About Case Data Retention

To control the number of stored cases and improve the overall performance of case queries, Stellar Cyber stores a case for a maximum of one year from the time of its last update.