Once you review an alert and determine there is cause for suspicion; you can convert the alert into a case.

Create a Case from an Alert

1. Start from any the alert generated from step 11 and 12:

3. Click on Manage in the Workflows section on the right hand side of the page.

📘

You need admin settings to create workflow buttons!

If you do not have permissions to create workflow buttons, please read through the remaining of this tutorial but not not complete the steps below. We also invite you to experiment with pre-exiting workflow buttons (such as "re-assign") that you may have access to.

4. Click + Create alert workflow buttons:

5. Select Case Creation:

6. Fill in the Workflow button creation modal according to the picture below:

7. Success! You have created a workflow button that can create a case from an alert:

8. Go back to the generated alert:

9. Click the newly generated workflow button Create Case:

10. Click Create New Case:

11. Congratulations, you have turned an alert into a case using workflow buttons!

Next, we will take a look at this case and how to investigate it moving forward.