<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-case-management
description: >-
  Implement and operate SOC case management workflows including incident
  tracking, evidence collection, timeline reconstruction, analyst collaboration,
  SLA enforcement, and integration with SIEM, SOAR, and ticketing platforms
  such as TheHive, ServiceNow, and Jira.
domain: cybersecurity
subdomain: soc-operations
tags:
  - case-management
  - incident-tracking
  - thehive
  - servicenow
  - jira
  - evidence
  - timeline
  - sla
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Case Management

## Overview

Case management provides structured tracking of security incidents from
detection through resolution. It maintains investigation context, evidence
chains, analyst collaboration notes, and compliance-required documentation.
Effective case management reduces mean time to resolve and ensures no
incidents fall through the cracks.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Case management platform (TheHive/SNOW/Jira) | Incident tracking |
| SIEM integration | Alert-to-case automation |
| SOAR integration | Automated evidence collection |
| Notification system | SLA breach alerts |

## Key Concepts

### Case Lifecycle

```
CASE LIFECYCLE:
├── 1. CREATION
│   ├── Auto-created from SIEM escalation
│   ├── Manual creation by analyst
│   └── Fields: title, severity, category, assignee, SLA
│   
├── 2. INVESTIGATION
│   ├── Evidence collection (logs, artifacts, screenshots)
│   ├── Timeline construction
│   ├── IOC documentation
│   ├── Analyst notes and findings
│   └── Collaboration with other teams
│   
├── 3. CONTAINMENT
│   ├── Containment actions documented
│   ├── Affected systems listed
│   ├── Business impact assessed
│   └── Stakeholder notifications sent
│   
├── 4. RESOLUTION
│   ├── Root cause identified
│   ├── Eradication steps completed
│   ├── Recovery verified
│   └── Detection rule improvements noted
│   
└── 5. CLOSURE
    ├── Final report generated
    ├── Lessons learned documented
    ├── Metrics updated (MTTR, severity)
    └── Case archived for retention
```

### TheHive Case Creation

```json
{
  "title": "Cobalt Strike Beacon Detected on FS01",
  "description": "EDR alert for Cobalt Strike beacon activity",
  "severity": 3,
  "tlp": 2,
  "pap": 2,
  "tags": ["cobalt-strike", "lateral-movement", "T1071"],
  "tasks": [
    {"title": "Validate EDR alert", "group": "Triage"},
    {"title": "Collect endpoint artifacts", "group": "Evidence"},
    {"title": "Isolate affected systems", "group": "Containment"},
    {"title": "Timeline reconstruction", "group": "Analysis"},
    {"title": "Write incident report", "group": "Closure"}
  ],
  "customFields": {
    "mitre-technique": {"string": "T1071.001"},
    "affected-systems": {"string": "FS01, WS023, WS024"},
    "data-classification": {"string": "Confidential"}
  }
}
```

### ServiceNow Security Incident

```json
{
  "short_description": "Ransomware detected - Finance department",
  "category": "Security Incident",
  "subcategory": "Malware",
  "priority": 1,
  "assignment_group": "SOC",
  "business_impact": "High - critical file server encrypted",
  "affected_ci": "FS01",
  "work_notes": "Initial triage: 47 endpoints affected. Backup status pending."
}
```

### Evidence Tracking

```spl
-- Splunk: Collect timeline events for case
index=sysmon OR index=winevent OR index=proxy
  (src="10.0.1.50" OR dest="10.0.1.50" OR Computer="FS01")
| where _time >= strptime("2026-03-15 08:00:00", "%Y-%m-%d %H:%M:%S")
| where _time <= strptime("2026-03-15 18:00:00", "%Y-%m-%d %H:%M:%S")
| eval evidence_type=case(
    index="sysmon", "endpoint",
    index="winevent", "authentication",
    index="proxy", "network",
    1==1, "other")
| sort _time
| table _time, index, sourcetype, evidence_type, src, dest, user, _raw
```

### SLA Configuration

```yaml
sla_policy:
  critical:
    response_minutes: 15
    update_interval_minutes: 60
    resolution_hours: 4
    escalation:
      - level: 1
        after_minutes: 15
        target: soc_lead
      - level: 2
        after_minutes: 60
        target: ciso
  high:
    response_minutes: 30
    update_interval_minutes: 120
    resolution_hours: 8
  medium:
    response_minutes: 60
    update_interval_minutes: 240
    resolution_hours: 24
  low:
    response_minutes: 240
    update_interval_minutes: 480
    resolution_hours: 72
```

## Workflow

1. **Create** — Generate case from alert or manual report
2. **Assign** — Route to appropriate analyst based on skills/load
3. **Investigate** — Collect evidence, build timeline, document findings
4. **Contain** — Execute and record containment actions
5. **Resolve** — Identify root cause, eradicate, verify recovery
6. **Close** — Final report, lessons learned, archive case
7. **Review** — Track SLA compliance and case quality metrics

## Verification

| Check | Method |
|---|---|
| Cases created from escalations | SIEM-to-case integration test |
| SLA timers enforced | Trigger test case, verify alerts |
| Evidence chain maintained | Case audit review |
| Reports generated on closure | Template output validation |
| Metrics tracked | Dashboard population check |
