Creating cases

Manual Case creation

To create a Case, click the Create Create button on the Suspicious Entity Details screen, or on the Cases screen, to display the Create Case window (for more information about the Suspicious Entity Details screen see “The Suspicious Entity Details Screen”.

CASE TITLE – Specifies the title of the case, which is searchable (for more information see Searching - Cases and Logs).

CASE TYPE – Provides the option to specify the type of case to be created as follows:

• Security Incident
  • (D)DoS
  • General Investigation
  • Improper Usage/Policy Violation
  • Malicious Probe
  • Scans and Probes
  • Unauthorized Access
• Health Incident – Specifies an issue with a solution device, software, or infrastructure.
• Change Request – Specifies a configuration change on the customer side that may require configuration changes to the Forescout Cloud setup for that customer.
• Technical Support – Specifies a request for technical support.

ASSIGNED TO – Selects the authorized Forescout Cloud user to which the case will be assigned.

DESCRIPTION – A place to provide an initial description of the Case, which can be edited and updated as the case progresses through investigation.

When a Suspicious Entity cannot be confirmed as benign and dismissed, a Security Incident Case is typically created to track the investigation until resolution. At this point, the terminology for the event in question changes form “Suspicious Entity” to “Security Incident”. The Triage screen will continue to display the Security Incident and sort it according to severity with the Case ID displayed.

Automatic Case creation

If you have ServiceNow integrated with the "AUTO-CREATE" feature enabled, eyeAlert will automatically generate a Security Incident case for all threat Detections and populate the case with the following fields and values:

• Title: [Entity] - System generated linked ServiceNow incident
• Description: System generated linked ServiceNow incident
• Created by: System
• Requested by: Null
• Case Severity: Inherited from the most offending detection
• Status: Detection & Analysis Incident
• Category: General Investigation

Case status is synchronized with ServiceNow if the "Auto-Synchronization" feature is enabled.