The case queue header provides quick access to key actions and display options
for managing and reviewing cases. Use the controls in the header to customize
your view, apply filters, and take bulk or individual actions on selected cases.
Navigate the case queue header
This section describes the available options on the case queue header.
Sort cases
You can sort cases in the queue based on various criteria to help with organization and prioritization. Available options include the following:
By ID: High to Low / Low to High
By Time Created: Newest to Oldest / Oldest to Newest
By Modified: Newest to Oldest / Oldest to Newest
By Playbook Status: Success to Failure / Failure to Success
By Priority: High to Low / Low to High
By SLA: Longest to Shortest / Shortest to Longest
Switch between side-by-side view and list view
Analysts can choose to see cases in either the side-by-side view (default when you open the Cases page) or the List view.
To switch between the side-by-side view and list view, click Cases view selection.
The List view displays all open cases in a single
space, which facilitates triage, sorting, filtering, customization, and updating
case information.
You can also do the following with the List view:
Manage columns: Click
view_column
Manage columns to hide or display specific columns.
Clickable Case ID: Click a case ID to open a specific case.
Both views support the following actions:
Apply Filters: Narrow your case search. Filters applied in one view also apply in the other.
For more information about filters, see
Apply and save filters.
Merge cases: For details about how to merge cases, see
Merge Cases.
Close cases: For details about how to close a case,
see
How to close cases.
Switch to Compact view
You can switch to a Compact view to display essential information like playbooks, their status, alerts count, and assigned roles. This view is useful for a quick glance at cases in the queue.
To switch to Compact view, click
sync_alt
Switch to Compact view.
Merge cases
You can merge cases directly from the case queue (from both the
side-by-side view and the List view). This lets you review
and consolidate the case information and determine which cases should be
merged.
Merge cases from the side-by-side view
To merge cases from the Side-by-side view, follow these steps:
Click Multiple Selection.
Select the required cases in the case queue.
Click menuMenu.
Click Merge Cases.
In the Merge Cases dialog, select the parent case that contains the merged cases.
Click Merge.
Merge cases from the List view
To merge cases from the List view, follow these steps:
Click Merge cases.
In the Merge Cases dialog, select the parent case that contains the merged cases.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThe Case Queue Header in Google SecOps SOAR provides options to sort, filter, refresh, and switch views of cases.\u003c/p\u003e\n"],["\u003cp\u003eCases can be sorted by ID, time created, modified time, playbook status, priority, and SLA time, with options for ascending or descending order.\u003c/p\u003e\n"],["\u003cp\u003eAnalysts can switch between Side-by-Side View and List View, with both views allowing for applying filters, creating manual cases, simulating cases, merging cases, and closing cases.\u003c/p\u003e\n"],["\u003cp\u003eThe List View allows analysts to see all open cases in one place, and you can also manage columns and click on the case ID to drill into a case.\u003c/p\u003e\n"],["\u003cp\u003eUsers can switch to a Compact View, which provides a concise display of case information like playbooks, status, alerts count, and role assignment, and cases can be merged in both the Side-by-Side and List Views.\u003c/p\u003e\n"]]],[],null,["Explore the case queue header \nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc)\n\nThe case queue header provides quick access to key actions and display options\nfor managing and reviewing cases. Use the controls in the header to customize\nyour view, apply filters, and take bulk or individual actions on selected cases.\n\nNavigate the case queue header\n\nThis section describes the available options on the case queue header.\n\nSort cases\n\nYou can sort cases in the queue based on various criteria to help with organization and prioritization. Available options include the following:\n\n- **By ID**: High to Low / Low to High\n- **By Time Created**: Newest to Oldest / Oldest to Newest\n- **By Modified**: Newest to Oldest / Oldest to Newest\n- **By Playbook Status**: Success to Failure / Failure to Success\n- **By Priority**: High to Low / Low to High\n- **By SLA**: Longest to Shortest / Shortest to Longest\n\nSwitch between side-by-side view and list view\n\nAnalysts can choose to see cases in either the **side-by-side** view (default when you open the **Cases** page) or the **List** view.\n\n- To switch between the **side-by-side** view and **list** view, click **Cases view selection**.\n\nThe **List** view displays all open cases in a single\nspace, which facilitates triage, sorting, filtering, customization, and updating\ncase information.\n\nYou can also do the following with the **List** view:\n\n- **Manage columns** : Click view_column **Manage columns** to hide or display specific columns.\n- **Clickable Case ID**: Click a case ID to open a specific case.\n\nBoth views support the following actions:\n\n- **Apply Filters** : Narrow your case search. Filters applied in one view also apply in the other. For more information about filters, see [Apply and save filters](/chronicle/docs/soar/investigate/working-with-cases/apply-and-save-filters).\n- **Create a manual case/simulate cases** : Click add **Add** to [Create a manual case](/chronicle/docs/soar/investigate/working-with-cases/create-a-manual-case) or [Simulate cases](/chronicle/docs/soar/investigate/working-with-cases/simulate-cases).\n- **Merge cases** : For details about how to merge cases, see [Merge Cases](/chronicle/docs/soar/investigate/working-with-cases/whats-on-the-case-queue-header#merge-cases).\n- **Close cases** : For details about how to close a case, see [How to close cases](/chronicle/docs/soar/investigate/working-with-cases/how-to-close-cases).\n\n\u003cbr /\u003e\n\nSwitch to Compact view\n\nYou can switch to a **Compact** view to display essential information like playbooks, their status, alerts count, and assigned roles. This view is useful for a quick glance at cases in the queue.\n\nTo switch to **Compact** view, click sync_alt **Switch to Compact view**.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nMerge cases\n\nYou can merge cases directly from the case queue (from both the\n**side-by-side** view and the **List** view). This lets you review\nand consolidate the case information and determine which cases should be\nmerged.\n\nMerge cases from the side-by-side view\n\nTo merge cases from the **Side-by-side** view, follow these steps:\n\n1. Click **Multiple Selection**.\n2. Select the required cases in the case queue.\n3. Click menu **Menu**.\n4. Click **Merge Cases**.\n5. In the **Merge Cases** dialog, select the parent case that contains the merged cases.\n6. Click **Merge**.\n\nMerge cases from the List view\n\nTo merge cases from the **List view**, follow these steps:\n\n1. Click **Merge cases**.\n2. In the **Merge Cases** dialog, select the parent case that contains the merged cases.\n3. Click **Merge**.\n\n\u003cbr /\u003e\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
Cases view selection.
Multiple Selection.
Merge cases.