diff --git a/docs/cases/cases-manage.asciidoc b/docs/cases/cases-manage.asciidoc index 967346d75b..c1b1258056 100644 --- a/docs/cases/cases-manage.asciidoc +++ b/docs/cases/cases-manage.asciidoc @@ -135,7 +135,7 @@ image::images/add-vis-to-case.gif[Shows how to add a visualization to a case] To add a Lens visualization to a comment within your case: -. Click the *Visualization* button. The **Add visualization** dialog appears.  +. Click the *Visualization* button. The **Add visualization** dialog appears. . Select an existing visualization from your Visualize Library or create a new visualization. + @@ -144,14 +144,16 @@ IMPORTANT: Set an absolute time range for your visualization. This ensures your + . Save the visualization to your Visualize Library by clicking the *Save to library* button (optional). -.. Enter a title and description for the visualization.  +.. Enter a title and description for the visualization. .. Choose if you want to keep the *Update panel on Security* activated. This option is activated by default and automatically adds the visualization to your Visualize Library. . After you've finished creating your visualization, click *Save and return* to go back to your case. . Click *Preview* to show how the visualization will appear in the case comment. -. Click *Add Comment* to add the visualization to your case.  +. Click *Add Comment* to add the visualization to your case. + +Alternatively, while viewing a <> you can open a panel's menu then click *More actions (…​) -> Add to existing case* or *More actions (…​) -> Add to new case*. + +After a visualization has been added to a case, you can modify or interact with it by clicking the *Open Visualization* option in the case's comment menu. -NOTE: Once a visualization has been added to a case, it cannot be modified or deleted. However, you can interact with the visualization by clicking the *Open Visualization* option in the comment menu. -   [role="screenshot"] image::images/cases-open-vis.png[Shows where the Open Visualization option is] @@ -222,7 +224,7 @@ To import a case: Be mindful of the following: * If the imported case had connectors attached to it, you'll be prompted to re-authenticate the connectors. To do so, click *Go to connectors* on the *Import saved objects* flyout and complete the necessary steps. Alternatively, open the main menu, then go to *Stack Management -> Alerts and Insights -> Rules and Connectors -> Connectors* to access connectors. -* If the imported case had attached alerts, verify that the alerts’ source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts’ source documents to function. +* If the imported case had attached alerts, verify that the alerts' source documents exist in the environment. Case features that interact with alerts (such as the Alert details flyout and rule details page) rely on the alerts' source documents to function. ========================= +