Security cases
Overview
Section titled “Overview”Detect & respond → Cases turns what Shield360 finds into work someone owns. A case gathers one or more pieces of evidence under one title, with:
- a severity (low, medium, high, critical) and an SLA due date set from it;
- an assignee, who must be a member of the organisation (never an Auditor);
- a status: new, investigating, escalated, resolved or dismissed (with a reason);
- the evidence it links to: violations, data-protection events, detections, analyst stories or reviewed interactions;
- comments and a timeline of every step, with who took it and when.
Cases belong to one environment (database configuration) of one project. A case in another environment is not found.
Prerequisites
Section titled “Prerequisites”| Permission | What it allows | Roles that have it |
|---|---|---|
cases.read | See cases, their evidence and timeline | Owner, Administrator, Compliance officer, Analyst |
cases.manage | Open, assign, comment on, link evidence to, escalate, resolve, dismiss and reopen cases | Owner, Administrator, Compliance officer, Analyst |
cases.reveal | See who a case is about. Every reveal is recorded. | Owner, Administrator, Compliance officer |
Cases are part of the Security module.
Open a case
Section titled “Open a case”- From the violations feed: in Govern → Policies & rules → Violations, select rows, then choose Open one case or One case per person. Only each row’s id is sent. Shield360 reads the event back from this environment’s own data, and takes what it says (category, outcome, tool, kinds of data), when it happened and who it is about from the stored record. An id from another environment, or of a kind of event your role cannot see, is not found. The masked snippet and any reason the person typed are never stored on the case.
- From a detection rule: switch on Open a case in the rule’s actions, or enable an insider-risk template. Each match opens a case, or adds to the case still open for the same rule and person.
- From the review queue: a review that finds a violation can open a case with the reviewed item as evidence. See Review queue.
- By hand: New case on the Cases page.
Every piece of evidence is named by its kind and id only; a request that describes it (facts, times or people) is refused. Violations, data-protection events, analyst stories and detection alerts are all read from their own store in the same environment.
Who a case is about
Section titled “Who a case is about”People are pseudonymised. A case keeps a keyed hash of the person’s (or computer’s) name, which shows as Person 3f9a1c, and the name encrypted. Someone with cases.reveal can choose Reveal to see the name. The reveal is written to the audit log (with the case id, never the name) and to the case’s timeline.
Alerts and audit records never carry a case’s title, description, comments, the assignee’s name or who it is about.
Work a case
Section titled “Work a case”| Step | From | To | Needs |
|---|---|---|---|
| Start investigating | New | Investigating | |
| Escalate | New, Investigating | Escalated | Optionally raises a corrective-action finding |
| Resolve | New, Investigating, Escalated | Resolved | A resolution |
| Dismiss | New, Investigating, Escalated | Dismissed | A reason: false positive, benign, duplicate, nothing to act on, or other (with a note) |
| Reopen | Resolved, Dismissed | Investigating |
A closed case cannot be reassigned or edited until it is reopened. If two people change a case at once, the second is asked to reload.
Escalate to a corrective-action finding
Section titled “Escalate to a corrective-action finding”When the problem is a control’s rather than one person’s, choose Also raise a corrective-action finding when escalating. This needs the Manage findings and corrective actions permission as well. The finding appears under Findings with the source Escalated security case and links back to the case.
SLA and notifications
Section titled “SLA and notifications”The due date defaults by severity: critical in 24 hours, high in 3 days, medium in 7 days, low in 14 days. You can change it.
Shield360 raises these alerts through your alert channels (Slack, Teams, email, webhooks, PagerDuty) wherever an event rule routes them:
| Alert kind | When |
|---|---|
case.assigned | A case is assigned to someone |
case.escalated | A case is escalated |
case.sla_breached | An open case passes its due date (once per due date; reopening or moving the due date can raise it again) |
The SLA check runs every five minutes with the detection scan.
Adding a source
Section titled “Adding a source”Case sources, evidence kinds and review sources are stored as text, not as database enums, so a new source (for example answer_report, a person reporting an AI answer from the Office add-in or Copilot) needs no migration. To add one, a developer adds it to the lists in src/client/src/lib/platform/cases/types.ts, labels it in the messages file, and reads the source’s record (ids and codes only) from its own store in the same environment in resolveEvidence (records.ts). The comment above CASE_SOURCES lists the steps.
Data protection
Section titled “Data protection”- An organisation export includes cases, their evidence, timeline, sampling policies and review items, never the encrypted name or its hash.
- A person export lists the cases and review items about the person. Erasure clears who they are about, and any case text or comment that names them, and keeps the case and its steps.