Investigate cases with Gemini

Supported in:

Gemini can answer your questions about cases, alerts, and playbooks within the Cases Management pages. You can ask questions specific to the page you're viewing, whether it's the Cases page, Alerts tab, or Playbooks tab

Ask Gemini case questions

  1. Make sure you're viewing one of the Case pages.

  2. Open the Gemini pane.

  3. Enter a case-related question in the prompt pane, using the following options:

    • If you're on the Case Overview or Case Wall tab, you can ask a question directly related to the case. For example, Give me the names of everyone who left comments on the Case Wall.

    • If you're on an Alerts tab, you can ask a question directly related to that alert. For example, Can you summarize this alert?

    • If you're on an Alerts Playbooks tab, you can ask a question directly related to any of the attached playbooks. For example, Is the first attached playbook using Virus Total?

  4. Review the results.

Delete a chat session

You can delete your chat conversation session or delete all chat sessions. Gemini maintains all user conversation histories privately and adheres to Google Cloud's responsible AI practices. User history is never used to train models.

  1. In the Gemini pane, select Delete chat from the menu at the top right.
  2. Click Delete chat at the bottom right to delete the current chat session.
  3. Optional: To delete all chat sessions, select Delete all chat sessions and then click Delete all chats.

Provide feedback

You can provide feedback to responses generated by the Gemini AI investigation assistance. Your feedback helps Google improve the feature and the output generated by Gemini.

  1. In the Gemini pane, click thumb_up Thumb Up or thumb_down Thumb Down.
  2. Optional: Click thumb_down Thumb Down and provide feedback.
  3. Click Send feedback.

Need more help? Get answers from Community members and Google SecOps professionals.