What's on the Case Queue Header?

Supported in:

casequeueheader1

The following options are available:

Sort sorticon

Sort cases in the queue based on the following options:

  • Sort by ID (High to Low)
  • Sort by ID (Low to High)
  • Sort by Time Created (Newest to Oldest)
  • Sort by Time Created (Oldest to Newest)
  • Sort by Modified (Newest to Oldest)
  • Sort by Modified (Oldest to Newest)
  • Sort by Playbook Status (Success to Failure)
  • Sort by Playbook Status (Failure to Success)
  • Sort by Priority (High to the Low)
  • Sort by Priority (Low to the High)
  • Sort by SLA (Longest to shortest)
  • Sort by SLA (Shortest to Longest) SLA time

Switch between Side-by-Side View and List View sbslistviewicon

Analysts can choose to see the cases in a Side-by-Side View or in a List View. When navigating to the Cases page, the default view is the Side-by-Side View.

To switch between Side-by-Side View and List View, click sbslistviewicon Side-by-Side/List View.

You can do the following in both the Side-by-Side View and List View:

  • Apply Filters: Allows you to narrow your case search to precisely target the cases you want to work with. Once you apply a filter, it will be applied in both the List View and in the Side-by-Side View. For more information about filters, see Apply and Save Filters.
  • Create a Manual Case/Simulate Cases: Click add Add to Create a Manual Case or Simulate Cases.
  • Merge Cases: For more information about merging cases, see Merge Cases.
  • Close Cases: For more information about closing a case, see How to close Cases.

    • What is the List View?

    With the List View, analysts can view all open cases in a single space, allowing easy triage. The List View is also a unified space for sorting, filtering, customizing, and updating case information.

    In addition to the capabilities listed above, you can also do the following in the List View:

    • Manage columns: Click view_column Manage columns to hide or display specific columns that provide particular case details.
    • Clickable Case ID: Click the Case ID number to drill down into a specific case. To go back into the List View from the case, click the arrow located to the left of the case title in the Case Top Bar.

    Switch to Compact View defaultcompactviewicon

    You have the option to switch to the compact view of the cases in the queue. It displays the case cards with the following information: playbooks, their status, alerts count, and the role assigned to it. This is useful when you want to have a quick glance at the cases in the case queue.

    Default View of the Case Card:

    defaultcompactview1

    To switch to Compact View, click sync_alt Switch to Compact view.

    Compact View of the Case Card:

    defaultcompactview2

    Merge Cases

    You can merge cases directly from the Case Queue (from both the Side-by-Side View and the List View). This allows you to easily review and consolidate the case information and determine which cases should be merged together.

    To merge cases from the Side-by-Side view:

    1. Click multipleselecticon Multiple Selection.
      2. mergecases1
    2. Select the required cases in the Cases Queue.
    3. Click format_list_bulleted Menu. Then, click Merge Cases.
      mergecases2
    4. The Merge Cases dialog box opens. Select the parent case you want to contain the other merged cases. Then, click Merge.
      mergecases3

    To merge cases from the List view:

    1. Click mergecasesicon Merge cases located in the top right of the page.
      2. mergecases4
    2. The Merge Cases dialog box opens. Select the parent case you want to contain the other merged cases. Then, click Merge.

    Need more help? Get answers from Community members and Google SecOps professionals.