> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Time Tracking
> Track analyst effort on cases and alerts, review worklogs, and manage approval and billing status.
Time Tracking records the effort analysts spend investigating cases and alerts. Analysts can run a live timer or log completed work manually, while authorized reviewers can approve worklogs and use the resulting totals for operational and cost reporting.
Start, pause, resume, stop, or discard one active timer from anywhere in the application.
Review descriptions, analysts, dates, categories, durations, entry types, billing state, and approval status.
Keep pending and rejected work visible while limiting approved totals and cost reporting to accepted entries.
## Where Time Tracking appears
Time Tracking is available on supported **Case** and **Alert** detail pages.
* The compact timer in the detail sidebar provides quick start, stop, and manual logging actions.
* The **Time** tab contains the active timer, summary metrics, category allocation, filters, and complete worklog history.
* When you navigate away from the item that owns an active timer, a floating timer remains available so the session is not hidden.
* The interface updates when timer or worklog changes arrive from another tab or authorized user.
Your deployment settings, active organization, parent-resource permissions, TLP access, and role determine which Time Tracking controls are visible. Alert Time Tracking can be rolled out independently from Case Time Tracking.
## Track work with the timer
Only one timer can be active for a user at a time. The elapsed time uses the server-backed session and excludes paused time.
Open the item you are working on. In the compact timer, optionally enter a description and choose an active time category.
Select **Start**. The timer changes to **Running** and remains available in the detail sidebar, the full Time tab, or the floating timer.
Select **Pause timer** to stop adding elapsed time without ending the session. Select **Resume timer** when work continues.
Select **Stop**. Review the description, category, and billable setting, then save the entry. The timer session becomes a `Timer` worklog.
### Switch to another item
CaseBender does not silently move a running timer. When you try to start work on another Case or Alert, use **Stop and switch**:
1. Review and save the current timer.
2. CaseBender creates the current worklog.
3. A new timer starts on the selected item.
This keeps time attribution explicit and prevents one investigation from receiving another investigation's elapsed time.
### Discard a timer
Use **Discard** only when the active session should not become a worklog. CaseBender asks for confirmation because the elapsed time is permanently omitted from active time reporting. The discard action is still recorded for audit purposes.
Discarding a timer cannot be undone from the Time Tracking interface. Stop and save the timer when the work should remain part of the investigation record.
## Log time manually
Use **Log time** when the work has already been completed or was performed away from the live timer.
1. Enter hours and minutes. A worklog must contain at least one minute.
2. Select the local calendar date on which the work occurred.
3. Add a concise description of the completed work.
4. Choose the most appropriate active category.
5. Set whether the work is billable when your permissions allow it.
6. Select **Log time**.
The resulting worklog is labeled `Manual`. System-created entries, when enabled by an applicable workflow, are labeled `Automatic`.
Use descriptions that explain the outcome, not only the activity. For example, prefer “Validated the suspicious sign-in and contained the account” over “Investigation.”
## Understand worklog status
Whether a new or edited worklog requires review is configured per user, with the deployment approval policy used as the fallback.
| Status | Meaning | Reporting behavior |
| ------------ | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| **Draft** | The entry is still being prepared by a supported system workflow. | Not included in approved totals. |
| **Pending** | The entry was submitted and requires approval. | Shown in pending totals; not included in approved totals. |
| **Approved** | An authorized reviewer accepted the entry, or the user is configured for automatic approval. | Included in approved, category, billable, and cost totals. |
| **Rejected** | A reviewer returned the entry with a correction reason. | Shown in rejected totals; not included in approved totals. |
Editing an entry sends it through the user's current approval policy again. Any previous approval or rejection metadata is cleared so the revised values can be evaluated consistently.
## Review and filter worklogs
The **Worklog history** presents the description as the primary content and groups the analyst, date, category, entry type, billing state, duration, and status around it.
Use the compact filter toolbar to narrow the history:
* **Date range** uses one start-and-end calendar selection.
* **Category** limits results to one active time category.
* **Analyst** selects entries from one user when your role allows cross-user access.
* **More filters** contains status, billable/non-billable, and entry type.
* **Clear filters** appears only when one or more filters are active and shows the active filter count.
Use **Load more** to continue through older entries without losing the active filters.
### Edit or delete your worklog
Open the worklog action menu to manage an entry:
* **Edit entry** changes the date, duration, description, category, or billable state.
* **Delete entry** removes the entry from active reports.
The standard Time tab exposes edit and delete actions only for the worklog owner with update access to the parent item. Deletion is soft: CaseBender keeps the immutable audit evidence while excluding the entry from active history and summaries.
## Approve or reject time
Super administrators and organization administrators with the required scoped finance and parent-resource permissions can review pending work.
### Approve from the Time tab
A pending row shows a clear **Approve** action. Use the action menu to reject the entry, then provide a meaningful correction reason for the analyst.
### Process the approval queue
Open **Finance → Approvals** to review pending entries across the authorized scope.
* Select one entry to approve or reject it.
* Enter a rejection reason before confirming a rejection.
* Select multiple entries and use bulk approval for a reviewed batch.
Approval triggers cost reconciliation for the accepted entry. Rejection preserves the worklog and reason so the analyst can correct and resubmit it.
## Read summary metrics
The Time tab separates work by approval state:
* **Approved** — accepted duration included in operational totals.
* **Pending approval** — submitted duration waiting for review.
* **Rejected** — returned duration requiring correction.
* **Approved billable** — accepted duration marked billable.
* **Approved time by category** — accepted duration allocated across categories.
Pending and rejected work remain visible but do not inflate approved or billable reporting.
## Alert promotion and Case attribution
When an Alert is promoted or linked to a Case, its time entries keep their Alert origin and also gain the Case attribution.
* The Alert Time tab continues to show the original work and links to the Case Time tab.
* The Case Time tab includes that Alert-origin work and identifies its provenance.
* CaseBender uses one authoritative worklog row, so the same duration is not added twice to Case totals.
* An active Alert timer is attached to the Case if promotion occurs while the timer is running.
This preserves the investigation history while producing one consolidated Case total.
## Permissions
Time Tracking follows the access controls of the parent Case or Alert.
| Action | Typical requirement |
| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| View the parent item and available time history | Parent `read` permission, organization/TLP access, and any reporting permission required for cross-user totals |
| Start, pause, resume, stop, discard, or manually log time | Parent `update` permission and write access |
| Edit a worklog from the Time tab | Worklog ownership and parent update access |
| Delete a worklog from the Time tab | Worklog ownership and parent update access |
| View cross-user summaries | Authorized management role and scoped finance read access |
| Approve or reject entries | Super administrator or organization administrator, plus scoped finance write and parent update access |
| Override billable or rate information | Scoped financial override permission |
Authorization is enforced by the server. A hidden or disabled control does not replace permission checks, and a sufficient role does not bypass organization, parent-resource, or TLP boundaries.
## Audit and realtime behavior
CaseBender records creation, edits, deletion, approval, rejection, timer start, pause, resume, stop, and discard events. Worklog access and bulk approval operations are also audited where applicable.
Time-entry and timer events are published to connected clients so active views converge without frequent polling. If realtime delivery is interrupted, the application periodically refreshes the authoritative active timer as a safety net.
## Deployment controls
Time Tracking is enabled by default in packaged and hosted deployments. Operators can explicitly disable either surface as an emergency kill switch or for a staged rollout.
| Environment variable | Scope |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `CASE_SIDEBAR_TIMER` | Shows the compact Case sidebar timer. Case Time history remains available when this compact surface is disabled. |
| `ALERT_TIME_TRACKING` | Controls the Alert timer/worklog interface and Alert-targeted writes. Existing records remain readable for audit and rollback verification. |
Unset flags resolve to enabled. Accepted enabled values include `true`, `1`, and `on`; accepted disabled values include `false`, `0`, and `off`. Invalid configured values resolve to disabled. These flags are process-wide, not organization-specific.
For a staged production rollout, explicitly disable both flags before deploying the new image. Enable Case tracking before Alert tracking, and verify timer, approval, cost, realtime, and reconciliation metrics before expanding access.
## Troubleshooting
### The Start or Log time action is missing
Confirm that the applicable rollout flag is not explicitly disabled, you can update the parent Case or Alert, and your active organization and TLP access include that item.
### A timer is already running elsewhere
Only one active timer is allowed per user. Open the floating timer or select **Stop and switch** from the new item.
### Approved totals did not increase
Check the worklog status. Pending and rejected entries are displayed separately and are excluded from approved totals until accepted.
### A promoted Alert appears in both views
This is expected. The Alert view shows origin attribution and the Case view shows the consolidated investigation. Both views reference the same authoritative worklog, so Case totals are not doubled.
### Another user's worklogs are unavailable
Cross-user history and summaries require an authorized management role, scoped finance read access, and access to the parent resource.
## Recommended practices
* Start the timer when focused work begins and pause it during interruptions.
* Stop and save before switching investigations.
* Use consistent categories for comparable reporting.
* Write outcome-oriented descriptions.
* Correct rejected work promptly and review the supplied reason.
* Reserve bulk approval for entries that have already been reviewed.
* Use **Discard** only for sessions that should not become worklogs.
## Related documentation
* [Working with Cases](/en/cases/working-with-cases)
* [Alert Detail View](/en/alerts/detail-view)
* [Access Control](/en/security/access-control)
* [Audit Logging](/en/security/audit-logging)