# Incident Case configuration overview

Incident cases can be started as needed. You can then add various types of information from the system to them, as well as your own comments.

The configuration of Incident Cases involves the following general steps:

1. Create an Incident Case.
2. Attach relevant Logs, Policy Snapshots, Memos, and files to the Incident Case.
3. Add the network elements involved in the incident to the Incident Case.
4. Add journal entries to the Incident Case.