Case Management

Case Management in ThreatStream Next Gen gives you a built-in way to manage intelligence-driven work without ever leaving the platform. Instead of jumping between ThreatStream and external ticketing systems, you can create, assign, track, and close cases right where your intelligence already lives. This keeps your workflow streamlined and ensures that all relevant context stays in one place.

When you create a case, you can choose from configurable case types that reflect how your team operates. You can assign the case to yourself or a teammate, update its status as work progresses, and collaborate through comments. At the same time, you can link the case directly to PIRs, observables and threat models, so all supporting intelligence is preserved alongside the work you’re doing—no copying, pasting, or losing context.

Anomali AI is embedded throughout the experience to help you move faster and make better decisions. As you work on a case, Anomali AI can generate summaries on demand and recommend next steps based on the case context. For asset- or host-based cases, it can even pre-enrich the case with related data before you open it, giving you immediate context and reducing manual investigation time. In addition, Organization Administrators can define case types with built-in Anomali AI prompts that reflect standard operating procedures of your organization, so every case starts with guided, consistent actions.

All cases are securely scoped to your organization, ensuring that sensitive intelligence work remains private. At the same time, permissions are flexible: everyone in your organization can view and comment on cases, while editing privileges are limited to the case owner, assignee, and Organization Administrators.