What's on the case queue header?

Supported in:
casequeueheader1

The case queue header includes the following options:

Sort sorticon

Sort cases in the queue based on the following options:

  • Sort by ID (High to Low)
  • Sort by ID (Low to High)
  • Sort by Time Created (Newest to Oldest)
  • Sort by Time Created (Oldest to Newest)
  • Sort by Modified (Newest to Oldest)
  • Sort by Modified (Oldest to Newest)
  • Sort by Playbook Status (Success to Failure)
  • Sort by Playbook Status (Failure to Success)
  • Sort by Priority (High to Low)
  • Sort by Priority (Low to High)
  • Sort by SLA (Longest to Shortest)
  • Sort by SLA (Shortest to Longest)

Switch between side-by-side view and list view sbslistviewicon

Analysts can choose to see the cases in the side-by-side view or in the List view. When navigating to the Cases page, the default view is the Side-by-side view.

To switch between the side-by-side view and list view, click sbslistviewicon Cases view selection.

You can perform the following actions in both the side-by-side view and the list view:

  • Apply Filters: lets you narrow your case search to precisely target the cases you want to work with. When you apply a filter, it will be applied in both the list view and side-by-side views. For more information about filters, see Apply and save filters.
  • Create a manual case/simulate cases: click add Add to Create a manual case or Simulate cases.
  • Merge Cases: for more information about how to merge cases, see Merge Cases.
  • Close Cases: for more information about how to close a case, see How to close Cases.

    • What is the List view?

    The list view lets you view all open cases in a single space, which facilitates triage. It also serves as a unified space for you to sort, filter, customize, and update case information.

    The list view also lets you:

    • Manage columns: click view_column Manage columns to hide or display specific columns with particular case details.
    • Clickable Case ID: click the Case ID number to drill down on a specific case. To go back into the list view from the case, click the arrow located to the left of the case title in the case top bar.

    Switch to Compact view defaultcompactviewicon

    Switch to the Compact view of the cases in the queue to display the case cards with the following information: playbooks, their status, alerts count, and the role assigned to it. This is useful when you want to have a quick glance at the cases in the case queue.

    Default view of the case card:

    defaultcompactview1

    To switch to Compact view, click sync_alt Switch to Compact view.

    Compact view of the case card:

    defaultcompactview2

    Merge cases

    You can merge cases directly from the case queue (from both the side-by-side view and the List view). This lets you review and consolidate the case information and determine which cases should be merged.

    To merge cases from the Side-by-side view:

    1. Click multipleselecticon Multiple Selection.
      2. mergecases1
    2. Select the required cases in the case queue.
    3. Click format_list_bulleted Menu.
    4. Click Merge Cases.

      5. mergecases2
    5. The Merge Cases dialog opens. Select the parent case you want to contain the other merged cases.
    6. Click Merge.

      7. mergecases3

    To merge cases from the List view:

    1. Click mergecasesicon Merge cases located in the top right of the page.
      2. mergecases4
    2. The Merge Cases dialog opens. Select the parent case you want to contain the other merged cases.
    3. Click Merge.

    Need more help? Get answers from Community members and Google SecOps professionals.