Working with Cases

The Cases view lets you manage cases generated by Stellar Cyber. A case is a set of multiple correlated alerts and entities constituting a potential unified security attack, ranked by a dynamically updated score indicating the severity of the attack. Stellar Cyber uses its machine-learning capabilities to generate cases automatically, grouping related alerts into a unified case for improved attack resolution. In addition, you can also create your own cases from any table that includes alerts (for example, Threat Hunting or Dashboards | PREDEFINED | Analyst View).

Cases offer the following benefits:

• Streamlined workflows matching standard security analyst procedures.

• Enact case-specific responses recommended by Stellar Cyber (for example, blocking an IP address) directly within the Case interface.

• Use Case Queues to focus the case displays on just those cases matching a specific workflow or role.

• Evidence Locker lets you store emails, PDFs, CSV files, and links to bolster your case.

• Full export capabilities let you share cases with executive staff, including AI-generated summaries, if enabled.

• Case Activity log tracks all events related to a case, providing a detailed audit trail.

• Optional integration with ServiceNow lets you use Stellar Cyber cases and alerts together with your existing help desk and ticket management solution.

• When AI Case Analysis is enabled in Global Settings, Stellar Cyber uses AI to add new details to the tabs in the Case Detail view:

  • Case Detail view's Detection tab includes AI-generated summaries once analysis has been run to accelerate investigations.

  • Case Detail view's Analysis tab includes a new Hypothesis panel and adds AI-generated summaries to the existing Timeline, and Observables panels, helping summarize alerts into a case-level story, reconstructing timelines, and explaining relationships between entities.

  • Case Detail view's Response tab provides tailored response recommendations, giving you clear context and next steps without the need to stitch alerts together manually.

• Alert Auto Triage is available through the purchase of an add-on license (a 7-day trial is also offered for evaluation). This feature automatically investigates alerts and assigns verdicts before you review them, helping you focus on the most relevant cases and reduce manual triage effort.

Cases evolve in real time as new alerts are discovered and associated with an attack, either automatically by machine learning or manually by a user. You can use cases as part of your standard SOC workflows to direct a proactive response to ongoing security issues, ensuring they are assessed, assigned, tracked, and resolved.

This article covers the following subjects related to cases in Stellar Cyber:

• Introducing the Cases Display

• Using Case Queues

  • Configuring Case Queues

  • Working with Case Queues

• Using the Cases Table

  • Searching the Cases Table

  • Filtering the Cases Table

  • Changing the Columns in the Cases Table

  • Performing Bulk Actions in the Cases Table

  • Standard Functionality in the Cases Table

• Configuring Case Settings

  • Setting Case Properties

  • Setting Correlation Options

  • Configuring Case Filters

  • Working with Case Queues

  • Configuring Case Metrics

• Drilling to the Case Detail Page

• Displaying Cases from Event Details

Refer to Understanding Cases for a detailed discussion of how cases are created and correlated.

Introducing the Cases Display

The Cases display consists of the following main components:

• Case Queues – The Case Queues panel is at the left of the Cases display and lists the configured case queues. A case queue is a display filter that focuses the case displays on just those cases that match specified criteria (tenancy, status, severity, tags, and so on), ensuring that teams see the cases that matter to them without being overwhelmed by those that do not.

• Cases Table – The Cases table is your starting point for working with cases. It provides a table of all cases in the selected Case Queue and time range with sortable and customizable columns. You can select any case to drill to its detail page. You can also use the filters at the left of the page to focus your work on cases that meet specified criteria.

The figure below illustrates the organization of the Cases display:

Using Case Queues

Case management queues let you organize cases into logical groups based on configurable rules or manual assignment. Each queue can represent a grouping by tenant, region, severity, SOC team, shift, subject matter expertise, and similar criteria. Analysts are assigned to specific queues and see only the cases within those queues, which reduces noise and helps them focus. A case can appear in multiple queues if it matches the conditions defined for each queue.

Configuring Case Queues

The following procedure describes how to create, define, and manage case queues. These steps are typically performed by administrators who need to segment case visibility and assign cases to analysts or teams based on specific operational requirements.

1. Go to Cases and open the Case Settings panel by selecting the gear icon located near the top of the narrow left panel on the Cases page.

   

2. In the Case Settings panel that appears, select the Queues tab and then select New Queue to open the queue builder.

   

3. Name the queue, choose the tenant scope and date range to define which cases the queue evaluates, and, optionally, enter a description.

   • For custom queues, the standard date range options extend from last 15 minutes through this past month. The default date range is this past week.

     If you require different date ranges than these, contact Stellar Cyber Customer Success.

   • When a queue is created or updated, Stellar Cyber performs re-indexing, which means it re-evaluates all existing cases in the selected time frame to determine which ones match the defined conditions. Selecting a longer time range increases the number of cases that must be re-evaluated, which can result in longer indexing times. When this occurs, a system message appears to notify you that the queue might take additional time to complete.

4. Define the queue conditions:

   • Select Add condition and choose from the same case fields available in case filters.

     When you include an assignee as a condition in a case queue definition, be careful that the field is appropriate for the value you enter. Use assignee_name when you enter the assignee’s display name, such as a name or email address shown in the UI. Use assignee when you enter the assignee’s internal user ID. If you choose assignee_name and then enter a user ID, or if you choose assignee and then enter a display name, the queue will not return any results because the field and value are mismatched.

   • By default, new queues include the condition status is New OR In Progress OR Escalated.

   • You can modify or remove this condition as needed. This default ensures that initial queue results focus on cases that require attention—new, actively investigated, or escalated—so analysts can prioritize triage and response.

   • Use Add inner group to create grouped conditions (inner groups) that act as logical subfilters for more complex matching.

   • You can combine conditions and inner groups with AND/OR/NOT logic.

     

5. In the Case Summary and Analysis section, choose whether Stellar Cyber performs AI-based analysis for the cases in this queue, and then select Save to add the queue.

   • Case Summary – Turn on this setting to have Stellar Cyber generate an AI case summary when a case enters the queue or changes while it is in the queue. A case summary uses the data already present in the case to generate a concise narrative that helps you quickly understand the case. It does not perform additional investigation or enrich the case with data from external sources. Case summaries are available to all customers with a valid platform license.

   • Auto-Triage – Turn on this setting to have Stellar Cyber also perform Alert Auto Triage on the alerts in the cases in the queue. Unlike case summaries, Alert Auto Triage automatically performs a multi-step investigation that can enrich the existing case data with information from integrated endpoint, identity, and threat intelligence sources. It uses Verdict Signal Checks to evaluate observables and supporting evidence and assigns verdicts to the alerts in the case. The Auto-Triage setting requires the Case Summary setting to be enabled and appears only when you have the Alert Auto Triage add-on license installed or are in an active trial. Turning off Case Summary automatically turns off Auto-Triage.

   The Case Summary and Analysis section appears only when a user with Super Admin privileges has enabled the Enable AI Case Analysis & Summary option in System | ORGANIZATION MANAGEMENT | Settings. For details, see AI Case Analysis .

   When a case enters the queue, or changes while it is in the queue, Stellar Cyber generates the case summary and, if enabled, performs alert auto-triage. AI-based analysis is subject to daily limits; for details, see Alert Auto Triage.

   

6. Repeat for additional queues as needed, up to the system limit of 20.

   To increase this limit, contact Stellar Cyber Customer Success.

7. Wait for the indexing process to complete.

   After a queue is created, Stellar Cyber indexes existing cases to identify which ones meet the defined conditions before displaying counts. The indexing process ensures the queue view reflects all eligible cases within the defined time range. When queue conditions are later modified, re-indexing occurs when related case data changes, such as when alerts are added or case attributes are updated. The queue count updates automatically once indexing is finished.

8. Communicate to analysts which queues they should use and their intended purpose.

   This is often done through SOC team briefings, documentation, or messaging.

Using the Cases Table

Cases matching the selected Case Queue and time range are shown in a sortable Cases table with customizable columns. By default, the All Open Cases queue is selected. The name of the Cases table changes to match the selected Case Queue.

You can select any case to drill to its detail page. You can also use the filters at the left of the table to focus your work on cases that meet specified criteria.

The tabular view lists each case on its own row with the following default columns:

• Tenant – The tenant with which this case is associated.

• Case ID – The system-assigned number for the case.

• Case Name – Stellar Cyber automatically assigns a name to each case it reports. You can either accept the default name or supply your own in the Case Detail view.

• Score – Stellar Cyber assigns scores to cases based on how critical they are. A case score updates in real time as events and entities are added to or removed from the case. Scores are color-coded to indicate the seriousness of the case.

• Severity – The severity of a case: Critical (75 and higher), High (50–74), Medium (25–49), or Low (1–24). Severity automatically changes with the case score until it is changed manually in the Case Detail view. Once you manually edit the severity of a case, it no longer updates automatically based on the case score. Severity indicators are color-coded to direct your attention to more serious cases.

• Creator – The user account that created the case. Cases created by Stellar Cyber are listed with a creator of System.

• What – The Tactic or Technique for the alert with the highest severity associated with this case.

• Who – The users and hosts associated with the case. You can find details on the observables for the case in the Analysis tab on the Case Detail page.

• Assignee – The assignee for the case, if any. Cases can be assigned to resources in the Case Detail view or by selecting the check box for a case at the left of the table and using the bulk edit controls that appear at the top of the table.

You can change the columns in the Cases table using the Column selector described in Changing the Columns in the Cases Table.

Searching the Cases Table

The Cases table includes a Search tool at the top of the display that lets you perform a text-based search using Lucene syntax for a specified value. Keep in mind the following when searching Cases:

• The data returned by the search is limited to just those entries that pass the current Case filters.

• The search is performed across all available pages of cases, not just the currently displayed page. For example, if there are three pages of 20 cases available in the Current Cases table, matches can be found on any of the three available pages, regardless of the sort order.

Not All Fields Supported for Searching

Filtering the Cases Table

Select the standard Filters icon at the left of the Cases table to open the Filters panel, where you can set display filters that focus the display on just those cases matching the criteria you supply.

Applied filters are summarized at the top of the Cases table and can be cleared by clicking the X in their entries. You can also use the Clear All button to clear all applied display filters.

Changing the Columns in the Cases Table

You can change the columns in the Cases table by selecting the Columns button at the left of the table to toggle open a panel where you can choose the columns to display.

The Tenant, Case ID, and Case Name columns always appear in the Cases table and cannot be hidden. You can select any additional columns you want to include in the table and clear those you don't.

Not All Columns Support Sorting

Performing Bulk Actions in the Cases Table

The Cases table supports bulk edits to the Status, Tags, or Assignee of multiple cases. Use the following procedure:

1. Select one or more cases in the Cases table by checking their boxes at the left of the table.

   New bulk edit controls appear at the top of the table, as illustrated below:

   

2. Select the type of bulk action you want to perform from the drop-down lists:

   • Status – The drop-down lets you select any of the standard Case statuses (Escalated, New, In Progress, Resolved, or Cancelled).

     Once the status of a case has been changed to either Resolved or Cancelled, Stellar Cyber no longer associates new alerts with it. Instead, new alerts are either used to create a new case or associated with a different open case.

   • Tags – The adjacent dropdown lets you select from any existing tags. You can also type in a new tag.

   • Assignee – The adjacent dropdown lets you select any existing user available to your tenancy.

3. Select Apply to apply your bulk action to the selected cases.

Keeping Track of Bulk Actions

Once you apply a bulk action to one or more cases, Stellar Cyber displays a success or failure message at the top of the display and keeps track of its progress in the Task List.

Here's an example of a Bulk Action that was successfully applied:

You can display the Task List using its icon at the top of the display, as illustrated below. The Task List keeps track of the progress, success, or failure of any bulk actions performed from the Current Cases table, as well as any other ongoing Stellar Cyber activities. Depending on the number of cases affected by a bulk action, it make take a few seconds for the action to complete. The Task List is useful in these situations, letting you see the progress of the action. Here's how you display the Task List, complete with some successful bulk actions:

You can clear individual tasks from the list using the standard close button at the upper right of their entries in the list. Clear all of the tasks using the Clear all link at the top of the list.

Standard Functionality in the Cases Table

The Cases table offers standard table functionality, including the ability to sort on a column, pin columns, autosize columns, reset column sizes, Export as CSV, or Change Columns.

Configuring Case Settings

Users with a root user scope and RBAC privileges that let them change user interface settings (for example, users assigned the default Super Admin role or a custom role with equivalent privileges) can select the Settings icon at the top of the Case Queues panel to access the following tabs:

• Case Properties – Set alert closure options.

• Correlation – Configure case correlation behavior.

• Case Filters – Configure case suppression logic to determine which cases are created.

• Queues – Configure customizable case queues that use detailed filter criteria to display cases specific to different roles, departments, workflows.

• Metrics – Configure case metrics to track the time of various case operations such as the acknowledgement of a case assignment, the action taken in response, and its resolution.

Changes made on these tabs apply globally to all cases.

Users without these privileges (such as users assigned the default Platform Admin role or a custom role with equivalent privileges) can still open Case Settings and configure the Case Filters and Queues tabs, but the Case Properties and Correlation tabs are not available.

Refer to Understanding Cases for a detailed discussion of how cases are created and correlated.

Configuring Case Filters

You can use case filters to control the automatic creation of cases by defining specific conditions under which Stellar Cyber suppresses their creation. Instead of generating a case for every group of related alerts, you can use case filters to prevent the creation of cases that are low risk, expected, or otherwise unimportant. This reduces case volume and helps you focus attention and resources on the alerts that matter most. This targeted suppression allows your team to maintain a streamlined, relevant case queue and reduce alert fatigue.

In the Case Settings section, you can create new filters, edit existing ones, or delete filters that are no longer needed. For detailed information about case filters, see Using Case Filters and the Filter Builder.

Configuring Case Metrics

Case metrics let you measure how long case operations take. Each metric is a timer that Stellar Cyber starts, pauses, and stops based on conditions you define, such as the time from case creation to acknowledgment by an analyst, or the total time from creation to resolution. You can then use these metrics to measure the response times of your SOC team against operational targets you track outside the Stellar Cyber Platform

Stellar Cyber applies every enabled metric automatically to all cases for all tenants, so you don't have to attach metrics to cases individually.

Creating a Case Metric

A new deployment starts with no metrics configured. Use the following procedure to create one.

1. In the Case Metrics tab, select + Create.

   The Create Case Metric dialog box appears.

   

2. Under Metric Details, enter a Name for the metric and, optionally, a Description.

   Because the name appears as a column heading in the Cases table, it's advisable to keep it short.

   Metric names must be unique. If you enter a name already in use, Stellar Cyber displays an error and you cannot save the metric until you change it.

3. To define the condition for triggering timers, either use one or more of Quick Start Templates or configure custom settings.

   To use templates, expand Use Quick Start Template and select Applyfor Time to Acknowledge, Time to Respond, or Time to Resolve.

   Applying a template fills in the name, description, and timer conditions with values that you can modify.

   

4. To configure custom metrics, define one or more conditions that trigger the timer.

   Each metric requires start and stop conditions; pause conditions are optional.

   • Start timer when – The timer starts when any of its conditions are met.

   • Pause timer when (optional) – The timer pauses when any of these conditions are met. Leave this section empty if the timer should never pause.

   • Stop timer when – The timer stops when any of these conditions are met.

   A paused timer resumes when a start condition is met again. Because some conditions can occur only once, consider this behavior when you pair pause conditions with start conditions. A timer that starts on Case Created would never resume after it pauses, as a case is created only once. A timer that starts on Case Assigned, or on a case field such as Status, can resume whenever that condition is met again.

   Select Add Condition in a section and choose a Field. Fields are grouped into events and case fields.

   Events describe something that happens to a case. An event either occurs or it does not, so it requires no operator or value. Selecting the event completes the condition. The available events are:

   • Case Assigned – An assignee is set for the case.

   • Case Closed – The case is closed.

   • Case Created – The case is created.

   • Case Reopened – The status of the case changes from a closed status to an open status.

   • Case Unassigned – The assignee is removed from the case.

   • Comment Added – A comment is added to the case.

   • Response Action Initiated – A response action is triggered on the case.

   Case Fields describe an attribute stored on the case. After choosing a case field, select an Operator and enter the value to compare against. The available case fields are Assignee, Created By, Modified By, Name, Resolution, Score, Severity, Size, Status, Tags, Tenant ID, and Ticket ID.

   The numeric fields Score, Size, and Ticket ID support is, is not, greater than, greater than or equal to, less than, less than or equal to, and in range. All other case fields support is and is not. The is and is not operators accept multiple values, and the condition is met when the field matches any of them. The in range operator provides From and To fields.

   Conditions within a section combine with OR logic, which means that the timer responds as soon as any single condition is met. Select Clear All to remove all conditions from a section.

5. Select Save Metric.

   New metrics are enabled by default. You can have a maximum of 10 case metrics, counting both enabled and disabled metrics. When you reach the limit, the Create option becomes unavailable. To add another metric at this point, you must delete one you no longer need.

   To increase this limit, contact Stellar Cyber Customer Success.

Managing Case Metrics

The Case Metrics tab lists each configured metric with its name, description, status, and available actions. Use the toggle in the Actions column to enable or disable a metric without deleting it, the Edit icon to modify it, and the Trash icon to delete it.

Selecting the Edit icon opens the Edit Case Metric dialog box, which provides the same fields as the Create Case Metric dialog box. Change the name, description, or any timer condition, and then select Update Metric.

The Use Quick Start Template option also appears in the Edit Case Metric dialog box. Applying a template replaces every value currently in the dialog box, including timer conditions you have already defined, and clears any section the template does not define. If you apply a template to an existing metric unintentionally, select Cancel rather than Update Metric.

Viewing Case Metrics

Each enabled metric is available as a column in the Cases table, hidden by default. To display a metric, open the column chooser and select it. Each cell shows the timer state and the corresponding duration: Not Started; In progress, with the time elapsed since the timer started; Paused, with the duration reached when the timer paused; or Completed, with the total duration. Durations appear in minutes, hours and minutes, or days and hours, depending on length.

The header of the Case Detail page includes a Metrics indicator showing how many of the metrics that apply to the case have completed, such as 0 / 3. Select the indicator to open the Case Metric Tracking panel, which lists each metric that applies to the case with its state and elapsed time. Select the refresh icon at the top of the panel to update the values.

Drilling to the Case Detail Page

You can select a case entry in the Cases table to drill to the Case Detail view for the corresponding Case.

Displaying Cases from Event Details

In addition to accessing the Cases table from the Cases menu, you can also display a filtered Cases table from the Cases list in the Event Details view for an alert.

The Cases list shows cases associated with the selected alert in descending order by score, up to a maximum of five. You can select the View All (x) link at the upper right of the list to open a new tab with a filtered view of the Case summary page showing just those cases associated with the selected alert. You can also select the entry for an individual case in the list to open its associated Case details page. The figure below shows the Cases list from the Event Details view of an alert: