Case Management

Case Management in ThreatStream Next Gen gives you a built-in way to manage intelligence-driven work without ever leaving the platform. Instead of jumping between ThreatStream and external ticketing systems, you can create, assign, track, and close cases right where your intelligence already lives. This keeps your workflow streamlined and ensures that all relevant context stays in one place.

When you create a case, you can choose from configurable case types that reflect how your team operates. You can assign the case to yourself or a teammate, update its status as work progresses, and collaborate through comments. At the same time, you can link the case directly to PIRs, observables and threat models, so all supporting intelligence is preserved alongside the work you’re doing—no copying, pasting, or losing context.

Anomali AI is embedded throughout the experience to help you move faster and make better decisions. As you work on a case, Anomali AI can generate summaries on demand and recommend next steps based on the case context. For asset- or host-based cases, it can even pre-enrich the case with related data before you open it, giving you immediate context and reducing manual investigation time. In addition, Organization Administrators can define case types with built-in Anomali AI prompts that reflect standard operating procedures of your organization, so every case starts with guided, consistent actions.

Access to cases is governed by permissions and a per-case access control list, and is not the same for every case. For details on which actions require which permission and access level, see Managing Access to Cases.