Investigate cases with Gemini

Supported in:

This document explains how to ask Gemini questions about cases, alerts, and playbooks directly from the Cases Management pages. Your questions are context-aware—based on the specific page or tab you're viewing, such as the Cases page, Alerts tab, or Playbooks tab.

Ask Gemini case questions

  1. Open one of the Case pages.
  2. Open the Gemini pane.

  3. Enter a case-related question in the prompt. The question can relate to the current tab:

    • Case Overview or Case Wall: Ask about case-level information. For example, Give me the names of everyone who left comments on the Case Wall.

    • Alerts: Ask about a specific question related to that alert. For example, Can you summarize this alert?

    • Alerts Playbooks: Ask about the behavior of attached playbooks. For example, Is the first attached playbook using Virus Total?

  4. Review the results returned by Gemini and refine your query if needed.

Delete a chat session

You can delete your chat conversation session or delete all chat sessions. Gemini maintains all user conversation histories privately and adheres to Google Cloud's responsible AI practices. User history is never used to train models.

  1. In the Gemini pane, select Delete chat from the menu at the top right.
  2. Click Delete chat at the bottom right to delete the current chat session.
  3. Optional: To delete all chat sessions, select Delete all chat sessions and then click Delete all chats.

Provide feedback

You can provide feedback to responses generated by the Gemini AI investigation assistance. Your feedback helps Google improve the feature and the output generated by Gemini.

  1. In the Gemini pane, click thumb_up Thumb Up or thumb_down Thumb Down.
  2. Optional: Click thumb_down Thumb Down and provide feedback.
  3. Click Send feedback.

Need more help? Get answers from Community members and Google SecOps professionals.