define({"topics" : [{"title":"Getting started with Incident Case elements","shortdesc":"<p class=\"shortdesc\">The Incident Case element allows you to gather together the data, actions, system configuration information, and files related to a specific incident. <\/p>","id":"GUID-B42FCE44-1A31-4426-BFE6-4231DC406C5D","href":"GUID-B42FCE44-1A31-4426-BFE6-4231DC406C5D.html","menu": {"hasChildren":true,},"tocID":"GUID-B42FCE44-1A31-4426-BFE6-4231DC406C5D-d58e21500","next":"GUID-B42FCE44-1A31-4426-BFE6-4231DC406C5D-d58e21500",},{"title":"Create Incident Case elements","shortdesc":"<p class=\"shortdesc\"> The Incident Case element stores the information related to the incident. <\/p>","id":"GUID-791DD8B1-E895-4A08-B88A-D2CC80E1DA2F","href":"GUID-791DD8B1-E895-4A08-B88A-D2CC80E1DA2F.html#GUID-791DD8B1-E895-4A08-B88A-D2CC80E1DA2F","menu": {"hasChildren":false,},"tocID":"GUID-791DD8B1-E895-4A08-B88A-D2CC80E1DA2F-d58e21562","topics":[]},{"title":"Set a context for Incident Case elements","shortdesc":"<p class=\"shortdesc\"> You can set a context for solving a particular Incident Case in the Management Client. <\/p>","id":"GUID-F70AB52A-1CFF-455B-BDA7-7FEAB8848FA1","href":"GUID-F70AB52A-1CFF-455B-BDA7-7FEAB8848FA1.html","menu": {"hasChildren":false,},"tocID":"GUID-F70AB52A-1CFF-455B-BDA7-7FEAB8848FA1-d58e21643","topics":[]},{"title":"Attaching data to Incident Case elements","shortdesc":"<p class=\"shortdesc\"> You can use the Data Collection tab to attach information to provide context for investigating the incident. <\/p>","id":"GUID-D9808AB1-9ED3-494D-A709-BB8B99ADE7A5","href":"GUID-D9808AB1-9ED3-494D-A709-BB8B99ADE7A5.html","menu": {"hasChildren":true,},"tocID":"GUID-D9808AB1-9ED3-494D-A709-BB8B99ADE7A5-d58e21674","next":"GUID-D9808AB1-9ED3-494D-A709-BB8B99ADE7A5-d58e21674",},{"title":"Add Players to Incident Case elements","shortdesc":"<p class=\"shortdesc\"> A player is any element that was involved in the incident. <\/p>","id":"GUID-3DD12C2D-8169-4040-A51E-697EA063F00A","href":"GUID-3DD12C2D-8169-4040-A51E-697EA063F00A.html","menu": {"hasChildren":false,},"tocID":"GUID-3DD12C2D-8169-4040-A51E-697EA063F00A-d58e21879","topics":[]},{"title":"Add journal entries to Incident Case elements","shortdesc":"<p class=\"shortdesc\"> The journal allows you to record your observations and comments about administrator actions during the incident investigation. <\/p>","id":"GUID-285EFBAE-40AB-42DB-8303-1E5892082AA9","href":"GUID-285EFBAE-40AB-42DB-8303-1E5892082AA9.html","menu": {"hasChildren":false,},"tocID":"GUID-285EFBAE-40AB-42DB-8303-1E5892082AA9-d58e21910","topics":[]},{"title":"Working with existing Incident Case elements","shortdesc":"<p class=\"shortdesc\"> After you have created an Incident Case element, you can edit the contents and properties of the Incident Case. <\/p>","id":"GUID-B9BEAE4C-56E3-430E-8C6B-EA22A035D0F8","href":"GUID-B9BEAE4C-56E3-430E-8C6B-EA22A035D0F8.html","menu": {"hasChildren":true,},"tocID":"GUID-B9BEAE4C-56E3-430E-8C6B-EA22A035D0F8-d58e21941","next":"GUID-B9BEAE4C-56E3-430E-8C6B-EA22A035D0F8-d58e21941",},{"title":"Example: Incident Case scenarios ","shortdesc":"<p class=\"shortdesc\"> There are many ways an administrator can become aware of suspicious activity in the system. The most likely way is by noticing something unusual in the logs or audit entries, or being warned about a potential problem in an alert. <\/p>","id":"GUID-85AA2BA2-94A6-4E81-B4EA-CCB4EA146105","href":"GUID-85AA2BA2-94A6-4E81-B4EA-CCB4EA146105.html","menu": {"hasChildren":true,},"tocID":"GUID-85AA2BA2-94A6-4E81-B4EA-CCB4EA146105-d58e22164","next":"GUID-85AA2BA2-94A6-4E81-B4EA-CCB4EA146105-d58e22164",}]});