> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Case Management

> The Case Management system is a comprehensive solution for tracking, managing, and resolving security incidents and investigations. This documentation covers all aspects of the case management functionality.

## Overview

Cases are the core entities for managing security incidents, investigations, and related activities. Each case represents a distinct security event or investigation that needs to be tracked and resolved.

!\[Case List View]
*Screenshot showing the main case list view with filters, search, and case cards*

## Key Features

* **Case Lifecycle Management**: Track cases from creation to resolution
* **Customizable Status Workflows**: Configure case statuses to match your organization's processes
* **Team Collaboration**: Assign cases to team members and track their progress
* **Rich Metadata**: Track severity, TLP (Traffic Light Protocol), and PAP (Permissible Actions Protocol)
* **Tagging System**: Organize cases with customizable tags
* **Integration with Alerts**: Link related alerts to cases
* **AI Insights**: Automated analysis and insights for cases (when enabled)
* **Audit Trail**: Complete timeline of case activities and changes

## Case Properties

### Core Properties

* **Case ID**: Unique identifier (auto-generated)
* **Title**: Descriptive name of the case
* **Description**: Detailed information about the case
* **Status**: Current state in the workflow (New, InProgress, Closed)
* **Severity**: Impact level (1-5)
* **TLP**: Traffic Light Protocol classification
* **PAP**: Permissible Actions Protocol level
* **Tags**: Custom labels for categorization
* **Custom Fields**: Organization-specific additional data

### Metadata

* **Created By**: User who created the case
* **Created At**: Timestamp of case creation
* **Updated At**: Last modification timestamp
* **Assigned To**: Team member responsible for the case
* **Organizations**: Associated organizations (for multi-tenant setups)

## Related Components

Cases are connected to several other components:

* **Alerts**: Security alerts that triggered or are related to the case
* **Observables**: Artifacts and indicators associated with the case
* **Tasks**: Action items and to-dos within the case
* **TTPs**: Tactics, Techniques, and Procedures identified in the case
* **Timeline**: Chronological record of case activities
* **AI Insights**: AI-powered analysis and recommendations (if enabled)

!\[Case Detail View]
*Screenshot showing the detailed view of a case with all its components and tabs*

## Next Sections

* [Creating Cases](./creating-cases.mdx)
* [Case Workflows](./workflows.mdx)
* [Working with Cases](./working-with-cases.mdx)
* [Case Settings](./settings.mdx)
* [AI Features](./ai-features.mdx)