> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-docs-core-features.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Case Management

Tracecat's case management system is designed to help you manage and track security incidents.
It's design is inspired by [Rapid7's SMAC (status, malice, action, context)](https://www.rapid7.com/blog/post/2021/02/12/talkin-smac-alert-labeling-and-why-it-matters/) methodology
and the [alert management system at Brex bank](https://medium.com/brexeng/elevating-security-alert-management-using-automation-828004ad596c).

## Open case

Use the [Open Case Action](/actions/open-case) in a workflow to open a new case.

## View cases

Go to the `Cases` tab to view all cases.
Cases are displayed in a table with the following columns:

<Card title="Payload" icon="lightbulb">
  A JSON object containing information about the case.
</Card>

<Card title="Status" icon="circle-check">
  Is the case `open`, `closed`, `reported`, `escalated`, or `resolved`?
</Card>

<Card title="Malice" icon="user-secret">
  Is the case payload indicative of malicious activity?
  There are only two options avaiable: `malicious` or `benign`.
</Card>

<Card title="Action" icon="bolt">
  What steps can I take to move towards closing or resolving this case?
</Card>

<Card title="Context" icon="tag">
  Context represents information not already captured in the case payload.
</Card>

## Best Practices

<Tip>
  To keep incident response repeatable, we recommend expressing case actions as a list of tags.

  For example, given a newly opened phishing email case, you might want want to set the tags: "quarantine" and "user-education".

  Check out the [MITRE D3FEND](https://d3fend.mitre.org/) matrix for ideas.
</Tip>

<Note>
  Tracecat automatically fills the case context with the following [MITRE ATT\&CK](https://attack.mitre.org/) labels (if applicable).

  For example:

  ```json
  {
    "tactic": "initial-access",
    "technique": "phishing",
    "procedure": "email-attachment",
    "threat_group": "0ktapus",
  }
  ```

  You can disable this AI feature in `settings`.
</Note>

## Add evidence

*Coming soon*

<Info>
  Multi-media evidence can be added to a case from the side panel.
  Tracecat supports the following evidence types:

  * Text
  * Images
  * Video
  * Audio
  * PDF
</Info>

## Close case

Select the case you want to close in the case table.
The case side panel will open.
Use the case status dropdown menu to change the case status to `Closed`.