To mark a case as an Incident, follow these steps:
On the Cases page, drill down to the relevant case.
Click
format_list_bulleted
Case Actions on the top right of the page and select
Incident.
Click Yes in the Confirmation dialog. The page refreshes
and the new incident appears in the case list with the incident icon and a red critical sidebar. The case is automatically assigned to a user with the SOC Manager role.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-04-22 UTC."],[[["You can mark a case as an incident within Google SecOps SOAR from the Cases page."],["To mark a case as an incident, select the \"Incident\" option from the \"Case Actions\" menu on the specific case page."],["Confirming the action will change the case to an incident, which will appear in the cases list with a red critical sidebar and an incident icon."],["Marking a case as an incident automatically assigns it to a user with the SOC Manager role."]]],[]]
