--- title: "The Details Drawer for Workflow Cases | ThreatConnect" slug: "the-details-drawer-for-workflow-cases" description: "This article describes the Details drawer for Workflow Cases and provides information on the actions you can perform from this drawer." tags: ["Viewing Data"] updated: 2025-04-30T11:14:18Z published: 2025-04-30T11:14:18Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # The Details Drawer for Workflow Cases ## Overview The **Details**drawer for a [Workflow Case](https://knowledge.threatconnect.com/docs/workflow-cases) in ThreatConnect® provides a detailed overview of the Case, including its [metadata](https://knowledge.threatconnect.com/docs/case-details), [associations](https://knowledge.threatconnect.com/docs/case-associations), [Artifacts](https://knowledge.threatconnect.com/docs/artifacts), and [Notes](https://knowledge.threatconnect.com/docs/case-notes). From this drawer, you can gather context about a Case and determine an appropriate course of action to take in your investigation. NoteFor information on the **Details**drawer for threat intelligence data objects (Indicators, Groups, Tags, Victims, and Victim Assets), see [*The Details Drawer*](https://knowledge.threatconnect.com/docs/the-details-drawer). ## Before You Start ### User Roles - To access the **Details**drawer for Cases in an Organization, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) except App Developer. ### Prerequisites - To have access to Workflow Cases, turn on Workflow for your Organization on the **Account Settings**screen (must be an Accounts, Operations, or System Administrator to perform this action). ## Accessing the Details Drawer for Cases Currently, you can access the **Details**drawer for Cases in the following areas of ThreatConnect: - the [**Search**screen](https://knowledge.threatconnect.com/docs/viewing-search-results) - [Threat Graph](https://knowledge.threatconnect.com/docs/viewing-details-in-threat-graph) - the [**Keyword Tracking & Results**card](https://knowledge.threatconnect.com/docs/viewing-intelligence-requirement-details#keyword-tracking-results) on the **Details**screen for [Intelligence Requirements (IRs)](https://knowledge.threatconnect.com/docs/intelligence-requirements) ## Details Drawer Layout Figure 1 shows the **Details**drawer for a Case. Depending on where you are viewing a Case’s **Details**drawer in ThreatConnect, the drawer’s header will include some or all of the following elements: ![Screenshot of the details drawer for a case](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20Details%20Drawer%20for%20Cases_7.9.0.png) - The Case’s ID number and name. - **View case in new tab![Open in New Tab icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Open%20in%20New%20Tab%20icon.png)**: Click this icon to [view the full details of the Case](https://knowledge.threatconnect.com/v1/docs/parts-of-a-case). - **+ Create Custom Report**: The **+ Create Custom Report**dropdown is available only when viewing a Case’s **Details**drawer on the [**Search**screen](https://knowledge.threatconnect.com/docs/viewing-search-results). Click **+ Create Custom Report**to display the following options: - **Create New**: Select **Create New**to [create a report for the Case that is not based on a report template](https://knowledge.threatconnect.com/docs/creating-a-report#creating-a-case-report). - **Create From Case Report Template…**: Select **Create From Case Report Template…**to [create a report for the Case from a saved Case report template](https://knowledge.threatconnect.com/docs/creating-a-report#creating-a-report-from-a-case-report-template). Then select a saved Case report template to use. - **Threat Graph**: The **Threat****Graph**button is available only when viewing a Case’s **Details**drawer on the **Search**screen. Click **Threat****Graph**to [view the Case in Threat Graph](https://knowledge.threatconnect.com/docs/viewing-an-object-in-threat-graph). Below the header, a Case’s **Details**drawer displays the following data in a read-only format: - **Description**: If a description has been entered for the Case, it will be displayed below the **Details**drawer header. - **Assignee**: The Case’s [assignee](https://knowledge.threatconnect.com/docs/parts-of-a-case#assignee). If the Case does not have an assignee, this section will be blank. - **Open Date**: The date and time when the Case was opened. - **Severity**: The Case’s [severity](https://knowledge.threatconnect.com/docs/parts-of-a-case#severity). - **Resolution**: The Case’s [resolution](https://knowledge.threatconnect.com/docs/parts-of-a-case#resolution). If a resolution has not been set for a Case, this section will display **Not Specified**. - **Workflow Template**: The [Workflow](https://knowledge.threatconnect.com/docs/workflows-and-workflow-templates) applied to the Case. If a Workflow has not been applied to the Case, this section will be blank. - **Case Status**: The Case’s [status](https://knowledge.threatconnect.com/docs/parts-of-a-case#status). - **Tags**: The [Tags applied to the Case](https://knowledge.threatconnect.com/docs/case-details#tags). - **Associations**: The Indicators, Groups, and Cases [associated](https://knowledge.threatconnect.com/docs/associations-card-for-cases) to the Case. - **Potential Associations**: The Indicators, Groups, and Cases suggested as [potential associations](https://knowledge.threatconnect.com/docs/potential-associations-card-for-cases) to the Case. - **Artifacts**: The [Artifacts](https://knowledge.threatconnect.com/docs/artifacts) added to the Case. - **Notes**: The [Notes](https://knowledge.threatconnect.com/docs/case-notes) added to the Case. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.* 20165-01 v.01.B ## Related - [The Details Drawer](/the-details-drawer.md)