There are three ways to create a new case:
Create a case on the Cases page and then manually add events.
Create a case from selected events.
Use an open alert and its corresponding events to create a new case.
To create a case on the Cases page:
From the main menu, select Investigate > Cases.
Click Create Case.
In the Create Case dialog, enter a name and an optional description.
Select the status of the case. For more information about statuses, see Understanding case details.
Set the Priority and Classification for the case.
(Optional) Choose an assignee for the case in the Assign to User drop-down menu.
Click Create Case.
Add events to the case as needed. For more information, see Adding events to an existing case.
To create a case using events:
Run an indexed search for events you want to include in your case, as described in Searching the data.
Select the checkbox next to the events you want to add to the case.
Open the Groupby slider by clicking on the arrow icon.
Click Add to Case.
In the Create Case dialog, complete the fields to create the case, as described in the previous procedure.
To create a case from an alert and its associated events, see Adding alerts to cases.