---
title: Cases
url: https://www.tines.com/docs/cases/
updated: 2026-02-18T20:52:54+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/llms.txt)*

# Cases

*[View on tines.com](https://www.tines.com/docs/cases/)*

> **NOTE:** Not seeing this feature? Talk to your tenant admin or [reach out to the Tines team](https://www.tines.com/contact-support/) to learn more.

Cases are a collaborative interface where you can organize information, comment, take action, and report on progress all in real-time. 

![](https://www.datocms-assets.com/55802/1769459535-cases-example2.png)

Here are just a few ways our customers use cases:

- [Triage suspicious alerts](https://www.tines.com/library/stories/1318807) or SIEM events using playbook or SOP
- [Evaluate IOCs](https://www.tines.com/library/stories/1235821) and [manage observables](https://www.tines.com/library/stories/1257293/?name=case-lifecycle-management) with detailed evidence
- [Investigate AWS ](https://www.tines.com/library/stories/1321356)issues via CLI
- [Deallocate and delete](https://www.tines.com/library/stories/1191903/?name=deallocate-and-delete-unnecessary-virtual-machines-in-azure-and-raise-tickets) stale virtual machines in Azure

Whether you're running down a security incident, managing a support request, triaging a flood of alerts, or coordinating an operational task, cases can flex to your needs.

> **TIP:** Check out the Tines University learning path for an in-depth course on becoming a [Cases specialist](https://www.tines.com/university/specialist-cases/).

---

## Getting started with cases

Cases can be opened manually with a few clicks inside Tines, or automatically by a story automation.

We recommend starting with a case template and building out content from there. 

Use  [case notifications](https://www.tines.com/docs/case-notifications/) and the [action template library](https://www.tines.com/docs/templates/) to interact with your case content.

### Navigating a case

Cases put information at your fingertips while staying flexible enough to fit your workflow. This [article](https://www.tines.com/docs/layout/) breaks down the layout of a case and how to navigate it's structure.

### Components of a case

Within the case structure are various components to display and interact with case data. This [article](https://www.tines.com/docs/components/) lists major case components and provides a summary of how they work.

### Working with records and dashboards

Records and dashboards are a powerful addition to building your cases workflow.

![](https://www.datocms-assets.com/55802/1767126003-cases-records-dashboards.png)

### Records

When you need to capture, transform, or reference structured data within your story, use a [record](https://www.tines.com/docs/records/). When **linked** to a specific case a record can provide helpful context. 

### Dashboards

You can then visualize that data from records and cases in a single view with [dashboards.](https://www.tines.com/docs/records-cases/dashboards) These views help you monitor what's happening across workflows within your team. 

## Trying out cases

Cases are an add-on feature for paid plans. By purchasing cases, you also gain access to records and dashboards. 

[Click here](https://hq.tines.io/pages/c88e1a237bed1f2e43fcf39d597ca6cd/) to start a one-time, 45-day trial.

---

## Learning more about cases

Continue reading to learn more about cases:

1. [Creating a case](https://www.tines.com/docs/creating-a-case/)
2. [Using case notifications](https://www.tines.com/docs/case-notifications/)
3. [Case groups](https://www.tines.com/docs/case-groups/)

Also be sure to explore some examples of case automations [in our library](https://www.tines.com/library/cases-records), and take a look at our latest [case product updates](https://www.tines.com/whats-new?category=cases).