# CaseBender - [API Reference (151 pages)](https://docs.casebender.com/_llms/en/api-reference.md): Documentation for API Reference. ## Documentation ### Getting Started - [Introduction](https://docs.casebender.com/en/introduction.md): Welcome to CaseBender Documentation - [Quickstart Guide](https://docs.casebender.com/en/quickstart.md): Securely deploy CaseBender on-premises with Docker Compose ### Deployment - [Deployment Overview](https://docs.casebender.com/en/deployment/overview.md): Choose a supported CaseBender deployment path - [First-run Setup](https://docs.casebender.com/en/deployment/first-run-setup.md): Activate a new on-premises CaseBender installation and create its first administrator - [Upgrading CaseBender](https://docs.casebender.com/en/deployment/upgrading.md): Safely upgrade your CaseBender deployment to the latest version without losing data, licenses, or credentials. - [Migrate a Legacy Docker Compose Installation](https://docs.casebender.com/en/deployment/legacy-compose-migration.md): Move an existing app/db/MinIO installation to the signed CaseBender release bundle without losing data, attachments, credentials, or audit integrity. - [Desktop Installer](https://docs.casebender.com/en/deployment/desktop-installer.md): One-click installer for deploying CaseBender locally - [Integration Execution Plane](https://docs.casebender.com/en/deployment/integration-execution-plane.md): Deploy and operate the credential control plane and dedicated connector workers. - [Deploy to OpenShift](https://docs.casebender.com/en/deployment/openshift.md): Deploy CaseBender on Red Hat OpenShift 4.x with the restricted-v2 overlay - [Deploy to Google Cloud Run](https://docs.casebender.com/en/deployment/google-cloud-run.md): Deploy CaseBender on Google Cloud Run with step-by-step instructions - [Deploy to AWS](https://docs.casebender.com/en/deployment/aws.md): Deploy CaseBender on Amazon Web Services (AWS) - [Deploy to Azure](https://docs.casebender.com/en/deployment/azure.md): Deploy CaseBender on Microsoft Azure - [Deploy to DigitalOcean](https://docs.casebender.com/en/deployment/digitalocean.md): Deploy CaseBender on DigitalOcean #### Storage - [Enterprise Storage Overview](https://docs.casebender.com/en/deployment/storage-overview.md): Architecture and operator entry point for CaseBender object storage - [Enterprise Storage Support Policy](https://docs.casebender.com/en/deployment/storage-support-policy.md): Current CaseBender storage support, qualification, and lifecycle policy - [Storage Provider Selection and Certification](https://docs.casebender.com/en/deployment/storage-provider-selection.md): Select a provider without confusing adapter compatibility with live certification - [OpenShift ODF and Ceph RGW Storage](https://docs.casebender.com/en/deployment/storage-openshift-odf-rgw.md): Connect CaseBender to customer-managed OBC or standalone Ceph RGW storage - [S3-Compatible Storage Certification](https://docs.casebender.com/en/deployment/storage-s3-compatible.md): Qualification policy for non-AWS products using the CaseBender S3 adapter - [Local Storage Limitations](https://docs.casebender.com/en/deployment/storage-local.md): Default Docker-volume storage is single-host; object storage is optional - [MinIO Lifecycle and Migration](https://docs.casebender.com/en/deployment/storage-minio-lifecycle.md): CaseBender policy for legacy MinIO Community Edition deployments - [Storage Security Baseline](https://docs.casebender.com/en/deployment/storage-security-baseline.md): Mandatory controls for uploads, object integrity, access, retention, and telemetry - [Storage Backup and Restore](https://docs.casebender.com/en/deployment/storage-backup-restore.md): Protect PostgreSQL and exact object versions as one consistency set - [Storage Migration Runbook](https://docs.casebender.com/en/deployment/storage-migration-runbook.md): Copy, verify, cut over, and roll back provider storage without data loss - [Storage Health and Troubleshooting](https://docs.casebender.com/en/deployment/storage-health-troubleshooting.md): Diagnose readiness, scanner, CA, permission, canary, and dead-letter failures - [Storage Release Security](https://docs.casebender.com/en/deployment/storage-release-security.md): Release qualification, SBOM review, and signed storage evidence - [Backup and Recovery](https://docs.casebender.com/en/deployment/recovery.md): Back up, restore, and recover an on-premises CaseBender installation #### Security - [Deployment Security](https://docs.casebender.com/en/deployment/security-hardening.md): Required security controls for production and air-gapped CaseBender deployments - [Security Remediation Release](https://docs.casebender.com/en/deployment/security-remediation-release.md): Upgrade impact and operator actions for the enterprise security remediation release - [Enterprise remediation rollout](https://docs.casebender.com/en/deployment/enterprise-remediation-rollout.md): Release gates, pilot controls, monitoring, and rollback procedures for security and access-control remediations. - [Permission Visibility Rollout](https://docs.casebender.com/en/deployment/permission-visibility-rollout.md): Stage permission-driven UI visibility without weakening authorization. ### Alert Management - [Alert List View](https://docs.casebender.com/en/alerts/list-view.md): Navigate and manage multiple alerts efficiently - [Alert Detail View](https://docs.casebender.com/en/alerts/detail-view.md): Comprehensive view of individual alert information - [Alert Observables](https://docs.casebender.com/en/alerts/observables.md): Manage indicators and observables associated with alerts - [Alert TTPs](https://docs.casebender.com/en/alerts/ttps.md): Track tactics, techniques, and procedures associated with alerts - [Alert Checklists](https://docs.casebender.com/en/alerts/checklists.md): Configure governed response checklists and complete required alert steps. - [Similar Alerts](https://docs.casebender.com/en/alerts/similar-alerts.md): Discover and analyze related alerts - [AI Insights](https://docs.casebender.com/en/alerts/ai-insights.md): Leverage AI-powered analysis for alert investigation ### Case Management - [Case Management](https://docs.casebender.com/en/cases/introduction.md): The Case Management system is a comprehensive solution for tracking, managing, and resolving security incidents and investigations. This documentation covers all aspects of the case management functionality. - [Creating Cases](https://docs.casebender.com/en/cases/creating-cases.md): This guide explains the different ways to create cases in the system and the available options during case creation. - [Case Workflows](https://docs.casebender.com/en/cases/workflows.md): Case workflows define how cases progress through your organization's incident response or investigation process. This guide explains how to work with and customize case workflows. - [Working with Cases](https://docs.casebender.com/en/cases/working-with-cases.md): This guide covers the day-to-day operations and features available when working with cases in the system. - [Case Settings](https://docs.casebender.com/en/cases/settings.md): This guide covers the configuration options and settings available for customizing the case management system. - [AI Features in Case Management](https://docs.casebender.com/en/cases/ai-features.md): This guide covers the AI-powered features available in the case management system, designed to enhance investigation efficiency and decision-making. ### Task Management - [Task Management](https://docs.casebender.com/en/tasks/introduction.md): The Task Management system provides a structured way to create, track, and manage action items within cases and investigations. - [Creating Tasks](https://docs.casebender.com/en/tasks/creating-tasks.md): This guide explains the different methods and options available for creating tasks in the system. - [Task Workflows](https://docs.casebender.com/en/tasks/workflows.md): This guide explains how tasks progress through different stages and how to manage task workflows effectively. - [Working with Tasks](https://docs.casebender.com/en/tasks/working-with-tasks.md): This guide covers the day-to-day operations and features available when working with tasks in the system. - [Task Settings](https://docs.casebender.com/en/tasks/settings.md): This guide covers the configuration options and settings available for customizing the task management system. - [Task Analytics](https://docs.casebender.com/en/tasks/analytics.md): This guide covers the analytics and reporting features available for monitoring and improving task management efficiency. ### Time Tracking - [Time Tracking](https://docs.casebender.com/en/time-tracking.md): Track analyst effort on cases and alerts, review worklogs, and manage approval and billing status. ### Analytics - [Analytics](https://docs.casebender.com/en/analytics/introduction.md): Comprehensive analytics and reporting features for monitoring alerts, cases, tasks, and analyst performance. - [Alert Analytics](https://docs.casebender.com/en/analytics/alert-analytics.md): Monitor and analyze security alerts with comprehensive metrics and visualizations. - [Case Analytics](https://docs.casebender.com/en/analytics/case-analytics.md): Track and analyze case management metrics with comprehensive visualizations and insights. - [Task Analytics](https://docs.casebender.com/en/analytics/task-analytics.md): Monitor and analyze task performance with comprehensive metrics and visualizations. - [Analyst Performance](https://docs.casebender.com/en/analytics/analyst-performance.md): Track and analyze individual and team performance metrics for security analysts. ### Audits - [Audit Logs](https://docs.casebender.com/en/audits/introduction.md): Track and monitor changes across alerts, cases, and system activities with comprehensive audit logging. - [Change History](https://docs.casebender.com/en/audits/change-history.md): Track and analyze changes to alerts, cases, and system configurations with detailed change history. - [Status Tracking](https://docs.casebender.com/en/audits/status-tracking.md): Monitor and analyze status changes and transitions with comprehensive status history tracking. - [Activity Logs](https://docs.casebender.com/en/audits/activity-logs.md): Track and analyze user activities and system events with comprehensive activity logging. - [Compliance Monitoring](https://docs.casebender.com/en/audits/compliance-monitoring.md): Monitor and ensure compliance with regulatory requirements and internal policies through comprehensive auditing. ### Settings - [Settings](https://docs.casebender.com/en/settings/introduction.md): Manage your CaseBender account, organization, security operations configuration, integrations, and platform preferences. - [License](https://docs.casebender.com/en/settings/license.md): View your CaseBender plan, seats, and Installation ID, and apply a paid license key. - [Session lifetime policy](https://docs.casebender.com/en/settings/authentication/session-lifetime.md): Configure inactivity and absolute session limits for an organization. - [Integrations](https://docs.casebender.com/en/settings/integrations/introduction.md): Configure and manage integrations with external services and systems in your CaseBender instance. - [Microsoft Defender XDR](https://docs.casebender.com/en/settings/integrations/microsoft-defender.md): Bi-directional integration between CaseBender and Microsoft Defender XDR (Windows Defender) for alert/incident ingestion and disposition sync. - [Microsoft Sentinel](https://docs.casebender.com/en/settings/integrations/microsoft-sentinel.md): Bi-directional integration between CaseBender and Microsoft Sentinel for incident ingestion (pull or push) and disposition sync. - [CrowdStrike Falcon](https://docs.casebender.com/en/settings/integrations/crowdstrike.md): Bi-directional integration between CaseBender and CrowdStrike Falcon for detection ingestion (pull or push) and disposition sync. - [Splunk](https://docs.casebender.com/en/settings/integrations/splunk.md): Bi-directional integration between CaseBender and Splunk (Enterprise Security) for notable/alert ingestion, HEC audit forwarding, and notable close-out sync. - [AWS GuardDuty](https://docs.casebender.com/en/settings/integrations/aws-guardduty.md): Ingest AWS GuardDuty findings into CaseBender by automatic polling (pull) or EventBridge webhook (push). - [ServiceNow](https://docs.casebender.com/en/settings/integrations/servicenow.md): Connect CaseBender to ServiceNow ITSM and CMDB with governed credentials and workflow actions. - [Jira](https://docs.casebender.com/en/settings/integrations/jira.md): Configure governed Jira issue automation and authenticated synchronization. - [Slack](https://docs.casebender.com/en/settings/integrations/slack.md): Connect Slack for notifications, channel operations, and approval workflows. - [Palo Alto Networks](https://docs.casebender.com/en/settings/integrations/paloalto.md): Run governed Panorama and Strata response actions from CaseBender. - [MISP](https://docs.casebender.com/en/settings/integrations/misp.md): Search, publish, and enrich threat intelligence with MISP. - [Google Cloud SCC](https://docs.casebender.com/en/settings/integrations/gcp-scc.md): Ingest Google Cloud Security Command Center findings into CaseBender by automatic polling (pull) or notification webhook (push). - [Tenable.io](https://docs.casebender.com/en/settings/integrations/tenable.md): Ingest Tenable.io vulnerability findings into CaseBender by automatic polling (pull) using the Vulnerability Export API. - [Proofpoint TAP](https://docs.casebender.com/en/settings/integrations/proofpoint.md): Ingest Proofpoint Targeted Attack Protection threat events into CaseBender by automatic polling (pull) using the SIEM API. - [Credentials and Connections](https://docs.casebender.com/en/settings/integrations/credentials-and-connections.md): Store secrets in the governed vault and bind them to reusable integration connections. - [Integration Operations](https://docs.casebender.com/en/settings/integrations/operations.md): Monitor connector health, action outcomes, catalog versions, and credential rotation. - [Workflows](https://docs.casebender.com/en/settings/workflows/introduction.md): Create and manage automated workflows to streamline your case management processes in CaseBender. - [Connector Actions](https://docs.casebender.com/en/settings/workflows/connector-actions.md): Use schema-driven installed integration actions in durable workflows. - [AI Settings](https://docs.casebender.com/en/settings/ai/introduction.md): Configure and manage AI providers to enable intelligent features in your CaseBender instance. - [Custom Fields](https://docs.casebender.com/en/settings/custom-fields/introduction.md): Create and manage custom fields to extend your case management capabilities in CaseBender. - [Observable Types](https://docs.casebender.com/en/settings/observable-types/introduction.md): Configure and manage observable types to categorize and track different types of indicators in your threat intelligence. - [Attack Patterns](https://docs.casebender.com/en/settings/attack-patterns/introduction.md): Browse and manage MITRE ATT&CK patterns to enhance your threat detection and response capabilities. - [Alert Statuses](https://docs.casebender.com/en/settings/alert-statuses/introduction.md): Configure and manage custom alert statuses to track the lifecycle of alerts in your security operations. - [Case Statuses](https://docs.casebender.com/en/settings/case-statuses/introduction.md): Configure and manage custom case statuses to track the lifecycle of cases in your security operations. - [Templates](https://docs.casebender.com/en/settings/templates/introduction.md): Create and manage templates to standardize case creation and response procedures in your security operations. - [Branding](https://docs.casebender.com/en/settings/branding/introduction.md): Customize the look and feel of your CaseBender instance with your organization's branding elements. #### Account - [Profile](https://docs.casebender.com/en/settings/account/profile.md): Manage your identity, avatar, password, and multi-factor authentication settings in CaseBender. - [Organizations](https://docs.casebender.com/en/settings/account/organizations.md): Create and govern CaseBender organizations, including hierarchy, TLP, retention, and administrator settings. - [Teams](https://docs.casebender.com/en/settings/account/teams.md): Create and manage CaseBender teams, membership, classification, escalation, and notification channels. - [Members](https://docs.casebender.com/en/settings/account/members.md): Invite, review, and manage CaseBender users, roles, and team assignments. - [Notifications](https://docs.casebender.com/en/settings/account/notifications.md): Review your notification inbox and configure personal channel, event, and Do Not Disturb preferences. - [API Keys](https://docs.casebender.com/en/settings/account/api-keys.md): Create, scope, monitor, rotate, suspend, revoke, and securely use CaseBender API keys. ## Security & Compliance ### Security Overview - [Security Overview](https://docs.casebender.com/en/security/overview.md): CaseBender is built for security teams and secured like one. Explore our enterprise-grade security controls, compliance frameworks, and transparent build pipeline. - [Security Architecture](https://docs.casebender.com/en/security/architecture.md): CaseBender's Zero Trust architecture, service isolation, network segmentation, and multi-tenant security design. - [Data Protection](https://docs.casebender.com/en/security/data-protection.md): How CaseBender protects your data with encryption, classification, secrets management, and retention policies. ### Authentication & Access - [Authentication](https://docs.casebender.com/en/security/authentication.md): Multi-factor authentication, SSO, account lockout, and step-up authentication in CaseBender. - [Access Control](https://docs.casebender.com/en/security/access-control.md): Implemented roles, scoped permissions, TLP ceilings, cross-team case grants, and API key scopes in CaseBender. - [Threat Detection](https://docs.casebender.com/en/security/behavioral-analytics.md): User and Entity Behavior Analytics (UEBA), insider threat detection, DDoS protection, and SIEM integration. ### Compliance Frameworks - [Compliance Overview](https://docs.casebender.com/en/security/compliance-overview.md): CaseBender supports 10+ compliance frameworks with built-in evidence collection, control testing, and audit management. - [SOC2 Type II](https://docs.casebender.com/en/security/compliance-soc2.md): How CaseBender helps you achieve and maintain SOC2 Type II compliance with automated evidence collection and control management. - [ISO 27001:2022](https://docs.casebender.com/en/security/compliance-iso27001.md): CaseBender's ISO 27001:2022 compliance support including ISMS controls, risk management, internal audit, and Statement of Applicability. - [GDPR & Privacy](https://docs.casebender.com/en/security/compliance-gdpr.md): CaseBender's GDPR compliance features including data subject rights, consent management, breach notification, and cross-border transfer controls. - [Additional Compliance Frameworks](https://docs.casebender.com/en/security/compliance-additional.md): CaseBender's support for CMMC, FedRAMP, HIPAA, PCI DSS, Export Control, and EU AI Act compliance. ### Security Assurance - [Security Assurance Program](https://docs.casebender.com/en/security/security-assurance.md): How CaseBender tests changes, blocks security regressions, protects release artifacts, and communicates assurance evidence to customers. - [Code Security](https://docs.casebender.com/en/security/code-security.md): Static analysis, dynamic testing, vulnerability management, penetration testing, and license compliance in CaseBender. - [Supply Chain Security](https://docs.casebender.com/en/security/supply-chain.md): How CaseBender secures its build pipeline with dependency management, container signing, SBOM generation, and SLSA provenance. - [Security Evidence Guide](https://docs.casebender.com/en/security/security-evidence.md): A guide for customers reviewing CaseBender scanner reports, SBOMs, signatures, provenance, exceptions, and assessment status. - [Independent Penetration Test Scope](https://docs.casebender.com/en/security/penetration-test-scope.md): Rules of engagement and minimum coverage for an independent authenticated CaseBender security assessment. ### Operations - [Audit Logging](https://docs.casebender.com/en/security/audit-logging.md): CaseBender's unified audit trail, integrity verification, SIEM forwarding, legal hold, and e-discovery support. - [Hardening Guide](https://docs.casebender.com/en/security/hardening-guide.md): Recommendations for hardening your CaseBender deployment including TLS, database, Redis, container, and monitoring configuration. ## OpenAPI Specs - [openapi](/en/api-reference/openapi.json) > The links below point to documentation indexes. Follow each `/_llms/` index recursively until you reach documentation pages. ## Indexes - [English / API Reference (151 pages)](https://docs.casebender.com/_llms/en/api-reference.md): Documentation for English / API Reference. - [Spanish (102 pages)](https://docs.casebender.com/_llms/es.md): Documentation for Spanish. - [French (102 pages)](https://docs.casebender.com/_llms/fr.md): Documentation for French. - [Italian (102 pages)](https://docs.casebender.com/_llms/it.md): Documentation for Italian. - [Japanese (102 pages)](https://docs.casebender.com/_llms/ja.md): Documentation for Japanese. - [Korean (102 pages)](https://docs.casebender.com/_llms/ko.md): Documentation for Korean. - [Brazilian Portuguese (102 pages)](https://docs.casebender.com/_llms/pt-br.md): Documentation for Brazilian Portuguese. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.