Skip to main content
Time Tracking records the effort analysts spend investigating cases and alerts. Analysts can run a live timer or log completed work manually, while authorized reviewers can approve worklogs and use the resulting totals for operational and cost reporting.

Live timer

Start, pause, resume, stop, or discard one active timer from anywhere in the application.

Worklog history

Review descriptions, analysts, dates, categories, durations, entry types, billing state, and approval status.

Governed reporting

Keep pending and rejected work visible while limiting approved totals and cost reporting to accepted entries.

​
Where Time Tracking appears

Time Tracking is available on supported Case and Alert detail pages.
  • The compact timer in the detail sidebar provides quick start, stop, and manual logging actions.
  • The Time tab contains the active timer, summary metrics, category allocation, filters, and complete worklog history.
  • When you navigate away from the item that owns an active timer, a floating timer remains available so the session is not hidden.
  • The interface updates when timer or worklog changes arrive from another tab or authorized user.
Your deployment settings, active organization, parent-resource permissions, TLP access, and role determine which Time Tracking controls are visible. Alert Time Tracking can be rolled out independently from Case Time Tracking.

​
Track work with the timer

Only one timer can be active for a user at a time. The elapsed time uses the server-backed session and excludes paused time.
1

Open the Case or Alert

Open the item you are working on. In the compact timer, optionally enter a description and choose an active time category.
2

Start tracking

Select Start. The timer changes to Running and remains available in the detail sidebar, the full Time tab, or the floating timer.
3

Pause when work is interrupted

Select Pause timer to stop adding elapsed time without ending the session. Select Resume timer when work continues.
4

Stop and review

Select Stop. Review the description, category, and billable setting, then save the entry. The timer session becomes a Timer worklog.

​
Switch to another item

CaseBender does not silently move a running timer. When you try to start work on another Case or Alert, use Stop and switch:
  1. Review and save the current timer.
  2. CaseBender creates the current worklog.
  3. A new timer starts on the selected item.
This keeps time attribution explicit and prevents one investigation from receiving another investigation’s elapsed time.

​
Discard a timer

Use Discard only when the active session should not become a worklog. CaseBender asks for confirmation because the elapsed time is permanently omitted from active time reporting. The discard action is still recorded for audit purposes.
Discarding a timer cannot be undone from the Time Tracking interface. Stop and save the timer when the work should remain part of the investigation record.

​
Log time manually

Use Log time when the work has already been completed or was performed away from the live timer.
  1. Enter hours and minutes. A worklog must contain at least one minute.
  2. Select the local calendar date on which the work occurred.
  3. Add a concise description of the completed work.
  4. Choose the most appropriate active category.
  5. Set whether the work is billable when your permissions allow it.
  6. Select Log time.
The resulting worklog is labeled Manual. System-created entries, when enabled by an applicable workflow, are labeled Automatic.
Use descriptions that explain the outcome, not only the activity. For example, prefer “Validated the suspicious sign-in and contained the account” over “Investigation.”

​
Understand worklog status

Whether a new or edited worklog requires review is configured per user, with the deployment approval policy used as the fallback. Editing an entry sends it through the user’s current approval policy again. Any previous approval or rejection metadata is cleared so the revised values can be evaluated consistently.

​
Review and filter worklogs

The Worklog history presents the description as the primary content and groups the analyst, date, category, entry type, billing state, duration, and status around it. Use the compact filter toolbar to narrow the history:
  • Date range uses one start-and-end calendar selection.
  • Category limits results to one active time category.
  • Analyst selects entries from one user when your role allows cross-user access.
  • More filters contains status, billable/non-billable, and entry type.
  • Clear filters appears only when one or more filters are active and shows the active filter count.
Use Load more to continue through older entries without losing the active filters.

​
Edit or delete your worklog

Open the worklog action menu to manage an entry:
  • Edit entry changes the date, duration, description, category, or billable state.
  • Delete entry removes the entry from active reports.
The standard Time tab exposes edit and delete actions only for the worklog owner with update access to the parent item. Deletion is soft: CaseBender keeps the immutable audit evidence while excluding the entry from active history and summaries.

​
Approve or reject time

Super administrators and organization administrators with the required scoped finance and parent-resource permissions can review pending work.

​
Approve from the Time tab

A pending row shows a clear Approve action. Use the action menu to reject the entry, then provide a meaningful correction reason for the analyst.

​
Process the approval queue

Open Finance → Approvals to review pending entries across the authorized scope.
  • Select one entry to approve or reject it.
  • Enter a rejection reason before confirming a rejection.
  • Select multiple entries and use bulk approval for a reviewed batch.
Approval triggers cost reconciliation for the accepted entry. Rejection preserves the worklog and reason so the analyst can correct and resubmit it.

​
Read summary metrics

The Time tab separates work by approval state:
  • Approved — accepted duration included in operational totals.
  • Pending approval — submitted duration waiting for review.
  • Rejected — returned duration requiring correction.
  • Approved billable — accepted duration marked billable.
  • Approved time by category — accepted duration allocated across categories.
Pending and rejected work remain visible but do not inflate approved or billable reporting.

​
Alert promotion and Case attribution

When an Alert is promoted or linked to a Case, its time entries keep their Alert origin and also gain the Case attribution.
  • The Alert Time tab continues to show the original work and links to the Case Time tab.
  • The Case Time tab includes that Alert-origin work and identifies its provenance.
  • CaseBender uses one authoritative worklog row, so the same duration is not added twice to Case totals.
  • An active Alert timer is attached to the Case if promotion occurs while the timer is running.
This preserves the investigation history while producing one consolidated Case total.

​
Permissions

Time Tracking follows the access controls of the parent Case or Alert. Authorization is enforced by the server. A hidden or disabled control does not replace permission checks, and a sufficient role does not bypass organization, parent-resource, or TLP boundaries.

​
Audit and realtime behavior

CaseBender records creation, edits, deletion, approval, rejection, timer start, pause, resume, stop, and discard events. Worklog access and bulk approval operations are also audited where applicable. Time-entry and timer events are published to connected clients so active views converge without frequent polling. If realtime delivery is interrupted, the application periodically refreshes the authoritative active timer as a safety net.

​
Deployment controls

Time Tracking is enabled by default in packaged and hosted deployments. Operators can explicitly disable either surface as an emergency kill switch or for a staged rollout. Unset flags resolve to enabled. Accepted enabled values include true, 1, and on; accepted disabled values include false, 0, and off. Invalid configured values resolve to disabled. These flags are process-wide, not organization-specific.
For a staged production rollout, explicitly disable both flags before deploying the new image. Enable Case tracking before Alert tracking, and verify timer, approval, cost, realtime, and reconciliation metrics before expanding access.

​
Troubleshooting

​
The Start or Log time action is missing

Confirm that the applicable rollout flag is not explicitly disabled, you can update the parent Case or Alert, and your active organization and TLP access include that item.

​
A timer is already running elsewhere

Only one active timer is allowed per user. Open the floating timer or select Stop and switch from the new item.

​
Approved totals did not increase

Check the worklog status. Pending and rejected entries are displayed separately and are excluded from approved totals until accepted.

​
A promoted Alert appears in both views

This is expected. The Alert view shows origin attribution and the Case view shows the consolidated investigation. Both views reference the same authoritative worklog, so Case totals are not doubled.

​
Another user’s worklogs are unavailable

Cross-user history and summaries require an authorized management role, scoped finance read access, and access to the parent resource.

​
Recommended practices

  • Start the timer when focused work begins and pause it during interruptions.
  • Stop and save before switching investigations.
  • Use consistent categories for comparable reporting.
  • Write outcome-oriented descriptions.
  • Correct rejected work promptly and review the supplied reason.
  • Reserve bulk approval for entries that have already been reviewed.
  • Use Discard only for sessions that should not become worklogs.

​
Related documentation