Move the investigation forward.
Keep the evidence with it.
Casebook brings alerts, evidence, ownership and response history into one case. Your SOC can decide what needs attention, put an analyst on it and carry the investigation through to a documented outcome.
as the case progresses
Selected signals shown. Review the full breakdown before applying a recommendation.
✓ An analyst confirms the assignment in this example.
Analyst records Closed · True positive, with a closure reason and the case history available for review.
The team investigates and records its decision. The case retains the evidence and history needed to explain the outcome.
Start the next decision with the work already done.
Bring linked alerts, indicators of compromise, affected entities and analyst notes into the same investigation. Casebook keeps the supporting detail close to the case, so a handoff does not begin with reconstructing the incident.
Follow the evidence.
Inspect events, indicators and entities from linked alerts. Add notes and attachments as the investigation develops.
See how the case got here.
Review its origin, agent activity and phase history. Completed, current and skipped phases carry different meanings.
Keep a usable record.
The timeline brings case activity and decisions together, with the actor and context available for review.
Work the risk behind the severity label.
Virtus Case Prioritizer combines weighted evidence into a risk score and priority recommendation. Alert severity, threat intelligence, affected entities, attack techniques, graph relationships, triage verdicts, alert velocity and business context help explain what deserves attention.
A visible breakdown gives the team a reason to change the queue, rather than another unexplained label.
- Alert severity
- 15.4
- IOC threat
- 14.4
- Entity risk
- 7.8
- MITRE coverage
- 9.1
- Graph connectivity
- 8.8
- Triage verdict
- 7.2
- Alert velocity
- 6.3
- Business context
- 3.0
Synthetic signal scores with default base weights. Optional signals and narrative are excluded from this example.
Know where machine learning contributes.
The base score uses a weighted formula. When configured and available, Cerebrum adds a learned estimate of false-positive likelihood from the case’s alerts. An optional language-model analysis can also explain and adjust the score within bounds.
Apply urgency with safeguards.
Automatic scoring for new cases is enabled by default. Manual runs can return a recommendation or apply it. The automated path respects a severity floor and will not change priority without evidence; applicable SLA targets follow the priority and phase.
Match the case to experience and capacity.
Virtus Case Router ranks analysts using the case context, declared skills and observed assignment outcomes. Workload and availability matter alongside experience, giving the team a basis for assignment beyond whoever picked up the last case.
Profiles + case history
Tools, training, certifications and seniority combine with observed work such as SLA performance and reopen history.
Rules first.
Machine learning when trained.
A deterministic ranker works from day one. A trained learning-to-rank model can then use your tenant’s assignment history.
Ranked analysts + reasons
Review suitable candidates, understand the match and keep a record of who takes ownership.
No automatic assignment on case creation.
Review recommendations and confirm an assignment.
Eligible new cases can be assigned automatically, subject to availability and routing constraints.
Router requires its module entitlement. A trained model requires sufficient labeled history; before that, deterministic ranking remains available. Model training does not itself enable automatic assignment.
Coordinate the work. Preserve the reason.
Use the case’s War Room to coordinate participants and tasks. Run available playbooks from the case when permitted, then review execution status alongside the investigation.
Keep participants and follow-up tasks attached to the case.
What happened.
What was done. Why it closed.
Record a disposition and closure reason. Phase history distinguishes work performed from stages skipped, while configured supervision can require review before closure.
Automatio supplies the playbook workflow; its configured action and approval controls still apply. Casebook keeps the response associated with the case.
Explore Automatio playbooksBegin with one investigation.
Bring a representative case and the people who will work it. Review the evidence, the priority decision and the ownership rules before expanding automation.
- 01Bring the context
Link the alerts and check the indicators and entities.
- 02Choose the controls
Review scoring, routing mode, permissions and supervision.
- 03Follow the outcome
Check the record another analyst will inherit.
Questions about Casebook.
1Does every case follow the same phases?
No. Casebook records actual phase history and distinguishes skipped stages from completed work. The illustration shows one possible journey, not a fixed sequence every case must execute.
2Are priority and assignment automatic?
They have separate controls. New-case automatic prioritization is enabled by default. Router defaults to Off; its Auto mode enables eligible automatic assignments. Manual prioritization and recommendation workflows remain available to authorized users.
3Do both capabilities use machine learning?
Router can use a trained model to rank analysts; until then it uses deterministic scoring. Prioritizer uses weighted risk signals and can incorporate Cerebrum’s learned false-positive estimate when configured and available. Its language-model narrative is optional.
4Does a closed case still explain the decision?
The case can retain its evidence, timeline, disposition and closure reason for review. Closing a case is distinct from deleting it. Write a useful reason so another analyst can understand the outcome.
Have another question? Talk to our team
Bring the case.
Keep the whole story.
See how evidence, priority and ownership come together in a Casebook investigation.