1. Docs
  2. Cases

Overview of cases

Last updated Open markdown version

Every case is built from four layers :

  1. Structure – The primary interaction points within a case

  2. Primitives – The core, built-in structural elements that every case has by default

  3. Properties – The contextual, user-defined details of a case

  4. Activities – The interactions that have occurred within a case or can be triggered from a case

Together, these layers give you a flexible but predictable surface you can navigate, extend, and automate against. This page explains what each layer contains and links to detailed documentation for each component.

Case structure

The case interface uses a visual hierarchy: high-level information appears at the top left, with detailed content toward the bottom right. When you open a case, start at the top-left to check the case status and key details, then work your way down and to the right to review content and access tools.

Primitives

Primitives are the core, built-in fields that every case has by default. They're native to the case object and can't be removed.

  • Team: the team the case belongs to (learn more)

  • Group: the group within the team the case is currently assigned to (learn more)

  • ID: globally unique identifier for the case

  • Status: the current state of the case using custom statuses you define

  • Priority: the importance of the case using CRITICAL, HIGH, MEDIUM, LOW, or INFO which also drives SLA timers

  • Assignees: select the user(s) assigned to work the case, or move a case to another team or group

  • Name: the title of the case

  • Tags: labels for categorization and filtering the case

  • Author: who created the case

  • Timestamps: describing when the case was created, last updated, and marked resolved

  • Description: large, free-text markdown body to introduce the case (learn more)

Properties

Properties are user-defined or system-augmented layers that add context on top of primitives. Most can be defined manually withing a case or updated via story automation.

  • Subscribers: users who have been mentioned in the case content or a comment, or have explicitly subscribed to a case to receive update notifications

  • Comments: collaborative discussion thread displayed withing the "Acitivity" section that supports filtering, rich text markdown, references, mentions, and file attachments

  • Fields: customizable, typed, and searchable data fields attached directly to a case (via case inputs), for example IP address, hostname, or alert source (learn more)

  • Tasks: actionable checklist items with assignees (learn more), also displayed in a progress indicator

  • Closure requirements: formulaic conditions that must be completed before a case can be closed

  • Linked cases: list of links to related cases

  • Blocks: a set of defined content types that format and structure the investigative documentation added by analysts (learn more)

    • Notes: formattable, rich-text markdown content consisting of text, tables, code snippets, pasted images, and dynamic mentions of many properties and primitives

    • Attachments: files associated with the case with an option to add annotations

    • Groups: grouping of blocks to improve readability and structure related content

  • Records: linked records from any team-scoped record type, augmenting the case's free-form content with relevant structured data (learn more)

Activities

Activities consist of two types: monitoring of things happening within a case and outbound triggering of Tines stories, opening pages, or external URLs

Inbound monitoring

Historical activities surface a timeline everything happening on a cas, from automated alerts to a full audit trail to human-triggered actions.

  • Subscriber notifications: alerts sent to case subscribers via email and in-app notification when something changes, for example a new comment, status update, or assignee change

  • Activity log: a full chronological audit trail of every change, comment, file, and status update on the case

Outbound Actions

  • Case actions: customiable buttons that trigger Tines stories and pages, or open external URLs directly from a case

Was this helpful?