Overview of cases - Splunk Documentation (2024)

• About
• Access Account Settings

• Start with Investigation in
• Manage the status, severity, and resolution of events in
• Approve actions before they run in
• Mark files and events as evidence in
• View recommended playbooks, actions, and mission experts for resolving an event
• Create, sort, and filter notes in
• Search within
• View the list of configured playbooks in
• Create Executive Summary reports and view all reports in
• Create custom lists for use in playbooks

• Create and investigate containers
• Overview of cases
• Create cases in
• Add objects to a case in
• Define a workflow in a case using workbooks in
• Create case reports to download and share in

Containers can be promoted to cases. You can use cases to consolidate information from multiple containers.

• Cases have phases and tasks, which are organized into workbooks to track and manage all the actions taken.
• Tasks can have playbooks and actions associated with them, allowing you to automate these actions. Automating actions allows to be used to track policy and compliance, and to fulfill documentation requirements.