Case content is where you build the narrative of an investigation — descriptions, notes, blocks, and comments that capture evidence, decisions, and context.
Every case has three content surfaces:
All three surfaces share the same rich-text editor powered by CommonMark and GFM formatting, slash commands (/), and @mentions.
How content flows into a case
Content can be authored in several ways:
Manually — type directly into the description, a block, or the comment composer.
Via a case template — pre-populate descriptions and blocks when a case is created.
Via story automation — use the Cases API or action templates to create and update descriptions, blocks, and comments programmatically.
Via paste — paste text, images, or case URLs directly into any rich-text surface.
Typical workflow
A case is created (manually or by a story) and the description is populated with initial context.
Blocks are added to organize evidence, remediation steps, timelines, or other structured sections.
Teammates collaborate via comments and @mentions in the activity timeline.
As the investigation progresses, key decisions from comments are promoted into the description or blocks.
The case is exported (PDF) or referenced in dashboards and records.
Content limits (summary)
For the full list, see Case limits
What's next
Writing and formatting learn the editor: slash commands, @mentions, images, code blocks, and CommonMark syntax.
Structure your case with blocks, block groups, colors, sensitive settings, and the table of contents.
Multiplayer collaboration — collaborate in real time and understand how comments relate to notifications.