Now that you understand why records and cases work together, let's explore the practical ways to link them. There are three main methods, each suited to different workflows and use cases.
Method 1: Attach records via stories
The most common approach is to have your story capture a record and attach it to a case automatically. This is ideal for real-time incident response when you want both the data and the workspace created together.
How it works:
Your story receives an event (like a security alert).
The story captures a record with the event details.
The story creates a case.
The story attaches the record to the case using the case ID.
When to use this: real-time incident response, automated triage workflows, or any scenario where you want data and workspace created together.
✋ Try this: Attach a record via story
Method 2: Link existing records to existing cases
Sometimes you'll discover that an existing record is relevant to a case you're already investigating. You can manually link records to cases directly from the records table.
How it works:
Navigate to the records table.
Select the record you want to link.
Click Add to case.
When to use this: during investigations when you discover related data, when correlating multiple incidents, or when adding historical context to an active case.
✋ Try this: Link an existing record to an existing case
Method 3: Create a new case from an existing record
If you're reviewing historical records and spot something that needs investigation, you can create a case directly from that record. This is perfect for turning data insights into actionable work.
How it works:
Navigate to the records table.
Select the record that needs investigation.
Click the Add to case dropdown.
Select + Create to create a new case.
When to use this: proactive threat hunting, compliance reviews of historical data, identifying patterns that need investigation, or following up on previously closed incidents.
✋ Try this: Create a new case from an existing record
Understanding these methods gives you flexibility in how you organize and track your work in Tines. Whether you're responding to a new incident, investigating an existing case, or turning historical data into actionable work, these connections ensure you can structure your workflows to match how your team actually operates.
Track record-case relationships
Understanding which cases a record is linked to helps you trace how data flows through your workflows and investigations. Each record stores a case_ids array showing which cases it's linked to. This array is automatically updated when you link or unlink a record from a case.
View linked cases from a record
Linked cases are visible directly in the records table, in the Cases column that displays linked case numbers. If a record is linked to multiple cases, all linked case numbers appear in the same column. Double-click any case number to open that case directly.
If a record isn't linked to any cases, the Cases column displays "None."