Mark a case as an incident

Supported in:

To mark a case as an Incident, follow these steps:

  1. On the Cases page, drill down to the relevant case.
  2. Click format_list_bulleted Case Actions on the top right of the page and select Incident.
  3. markcaseincident1
  4. Click Yes in the Confirmation dialog. The page refreshes and the new incident appears in the case list with the incident icon and a red critical sidebar. The case is automatically assigned to a user with the SOC Manager role.
  5. markcaseincident2

Need more help? Get answers from Community members and Google SecOps professionals.