--- title: "Case Details | ThreatConnect" slug: "case-details" description: "This article describes the elements included in the Case Details card of a Workflow Case and provides instructions on how to update each element." tags: ["Case Management"] updated: 2023-08-17T19:49:36Z published: 2023-08-17T19:49:36Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Case Details ## Overview The **Case Details**card, located at the top right of a [Workflow Case](/v1/docs/workflow-cases), displays important details about the Case, including time-based information related to the Case, Tags that have been applied to the Case, and a description of the Case. This article describes the elements included in the **Case Details**card, as well as how to update each element. ## Before You Start | Minimum Role(s) | - Organization role of Read Only User (for viewing the **Case Details**card and its contents) - Organization role of Standard User (for updating a Case's **Time of Occurrence**, **Time of Detection**, **Case Open Time**, and **Case Close Time**; applying and removing Tags; and updating a Case's description) | | --- | --- | | Prerequisites | - Workflow enabled by a System Administrator - A [Workflow Case created in your Organization](https://knowledge.threatconnect.com/docs/creating-cases) | ## Case Details Card Figure 1 shows an example of a **Case Details**card for a Workflow Case. NoteTo collapse or expand the **Case Details** card, hover the cursor anywhere in the card and click the arrow displayed at the upper-right corner of the card. ![Figure 1_Case Details_7.2.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Case%20Details_7.2.0.png) - **Time of Occurrence**: The date and time when a security incident or threat occurred. - **Time of Detection**: The date and time when a security incident or threat was detected (e.g., by a security team). - **Case Open Time**: The date and time when the Case was opened. - **Case Close Time**: The date and time when the Case was closed. - **Tags**: A list of standard Tags and [ATT&CK® Tags](https://knowledge.threatconnect.com/docs/attack-tags) applied to the Case. These are the same [Tag objects](https://knowledge.threatconnect.com/v1/docs/applying-tags) used throughout ThreatConnect®. - **Description**: A description of the Case. The four time-based elements (**Time of Occurrence**, **Time of Detection**, **Case Open Time**, and **Case Close Time**) are used to calculate the **Mean Time to Detection (MTTD)**,**MTTD Average**, **Mean Time to Resolution (MTTR)**, and **MTTR****Average** [**Cases**metrics](/v1/docs/cases-metrics) [dashboard](/v1/docs/dashboard) cards. ### Time of Occurrence To set or update a Case's **Time of Occurrence**, hover over the **Time of Occurrence**label and then click **Edit**![A close up of a device Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png). A date and time selector will be displayed (Figure 2). ![Calendar Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Case%20Details_7.2.0.png) - Select the desired date and time. - Click **Save**![A picture containing table Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon_Case%20Details.png)to save your changes. ### Time of Detection To set or update a Case's **Time of Detection**, hover over the **Time of Detection**label, click **Edit**![A close up of a device Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png) to display a date and time selector similar to the one in Figure 2, select the desired date and time, and then click **Save**![A picture containing table Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon_Case%20Details.png). ### Case Open Time A Case's **Case Open Time** is set whenever the Case is created. If a Case is closed and re-opened at a later time, its **Case Open Time** will reflect the date and time that it was first opened, not the date and time that it was re-opened. You can update a Case's **Case Open Time**, which is helpful in situations such as when a Case is opened on a Friday evening, but is not worked on until the following Monday. To update a Case's **Case Open Time**, hover over the **Case Open Time**label, click **Edit**![A close up of a device Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png)to display a date and time selector similar to the one in Figure 2, select the desired date and time, and then click **Save**![A picture containing table Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon_Case%20Details.png). NoteA [Timeline Event](/v1/docs/timeline-events) titled “Case Open Time Was Manually Changed” will be logged when you edit a Case's **Case Open Time**. ### Case Close Time A Case's**Case Close Time** is set whenever the Case is closed. If a Case is closed and re-opened at a later time, its **Case Close Time**will no longer have a value assigned to it. If the Case is closed again, its **Case Close Time** will reflect the new date and time that it was closed. While a Case is open, you cannot set or update its **Case Close Time**; however, you can do so once the Case is closed. To update a closed Case's **Case Close Time**, hover over the **Case Close Time**label, click **Edit**![A close up of a device Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png)to display a date and time selector similar to the one in Figure 2, select the desired date and time, and then click **Save**![A picture containing table Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon_Case%20Details.png). NoteA [Timeline Event](/v1/docs/timeline-events) titled “Case Close Time Was Manually Changed” will be logged when you edit a Case's **Case Close Time**. ### Tags To apply Tags to a Case, click **Edit![Edit button_Details card_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)**in the **Tags**section of the **Case Details**card, or click on the **Tags**section. The Case's Tags will now be editable (Figure 3). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Case%20Details_7.2.0.png) NoteTags without an icon to the left of their name are standard Tags that have not been [normalized to a main Tag through a Tag normalization rule](https://knowledge.threatconnect.com/docs/tag-normalization#creating-and-enabling-tag-normalization-rules). Tags with an![Main Tag icon_Details Screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Main%20Tag%20icon_Details%20Screen.png)icon are [main Tags](https://knowledge.threatconnect.com/docs/tag-normalization#viewing-main-tag-details)–that is, standard Tags for which a normalization rule has been enabled so that Tags defined as synonymous to the main Tag are converted to the main Tag when applied to an object. Tags with an![ATT&CK Tag icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/ATT&CK%20Tag%20icon.png)icon are [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags). - Begin entering text into the****text box. As you type, one of the following menus will be displayed: - If there are existing standard Tags or ATT&CK Tags that match part or all of the entered text, a menu containing those Tags listed under **Standard Tags**and **ATT&CK Tags**headings, respectively, will be displayed. Select a Tag from the menu to add it to the text box. - If there are no existing Tags that match the entered text, a menu with the **+ Add “<*entered text*>” as a new tag**option will be displayed. Select this option to create a new Tag that matches the entered text and add it to the text box. - Click the **Confirm![Confirm icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)**button to the right of the text box to apply the Tag(s) to the Case. If you created a new Tag that matches a synonymous Tag listed in a [Tag normalization rule](https://knowledge.threatconnect.com/docs/tag-normalization), it will be converted to the main Tag listed in the rule. Similarly, if you created a new Tag that [matches an ATT&CK Tag](https://knowledge.threatconnect.com/docs/attack-tags#converting-standard-tags-to-attck-tags), it will be converted to that ATT&CK Tag. NoteBy default, any new Tag that exactly matches an ATT&CK Tag will be converted to that ATT&CK Tag. If a Tag’s owner is added to the **Approximate Match**ATT&CK Tag conversion rule, any new Tag created in that owner that exactly or approximately matches an ATT&CK Tag will be converted to that ATT&CK Tag. ### Description To edit a Case's description, hover over the **Description** section and click **Edit**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20Case%20Description.png)at the upper-left corner of the text box. The Case’s description will now be editable (Figure 4). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Case%20Details_7.2.0.png) - Make any desired changes to the Case's description. - Click **Save**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon_Dark_Case%20Details.png)to save your changes. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.* 20126-01 v.02.A ## Related - [Applying Tags](/applying-tags.md) - [Cases Metrics](/cases-metrics.md) - [Parts of a Case](/parts-of-a-case.md) - [Timeline Events](/timeline-events.md) - [Workflow Overview](/workflow-overview.md)