Creating and managing Security Incident cases

Clicking the Cases from the main menu displays the Cases screen, which allows users to create, manage, filter, and track and cases for Security Incidents, Health Incidents, product Change Requests and Technical Support requests. Forescout supports integration with the leading case management systems for seamless case tracking - see App Integration Management in the Forescout Cloud Administration Guide for more information.

Users can manage the display of cases as follows:

FILTER – A top-level filter that narrows relevant displayed cases based on user, as follows:

  • All Cases
  • My Cases
  • Assigned To
  • Created By
  • Requested By

STATE – Filters displayed cases by “Open” and “Closed”.

TYPE – Filters displayed cases by type, as follows:

  • Security Incident
  • Health Incident
  • Change Request
  • Technical Support
  • Pending Customer Approval
  • Post Review
  • Remediation
  • Requested
  • Scheduled
  • Submitted
  • Troubleshooting
  • Waiting on Customer

Enable the Notable Case and/or Threat Hunting checkboxes to limit the displayed results to cases with those flags.

STATUS – Filters displayed cases by the following status indicators:

  • All
  • New: A case has been created but has not yet been worked on.
  • Change Planning: Actions are being planned before implementation.
  • Containment: Immediate actions are being taken to isolate or mitigate the threat.
  • Detection and Analysis: The case is actively being investigated for threats.
  • Escalated to Customer: The case requires customer action or validation.
  • Escalated to Technical Support: The case has been forwarded to the technical team for deeper analysis.
  • Escalated to Threat Intelligence: The case requires additional threat research or intelligence.
  • Identified: A potential security threat has been confirmed.
  • Implemented: A security fix or mitigation has been successfully applied.
  • Pending Customer Approval: The case is waiting for customer authorization before proceeding.
  • Pending Investigation: The case has been assigned but investigation has not started.
  • Post Review: The case is under review after containment and remediation.
  • Remediation: Actions are in progress to fix the identified issue.
  • Requested: A request for action has been made, but work has not yet started.
  • Returned to SOC: The case has been sent back to the SOC team for further investigation.
  • Scheduled: A remediation or mitigation action is planned but not yet executed.
  • Submitted: The case has been sent for review or approval.
  • Troubleshooting:​ Active debugging or testing is being performed on the case.
  • Waiting on Customer: The case is on hold until the customer provides the required input.

SEVERITY – Filters Security Incidents by severity level.

IMPACT – Filters Security Incidents by impact level.

LAST MODIFIED – Filters Security Incidents by the time they were last modified.