Case Management

Case Management

Case Management provides a complete workflow to create, investigate, and report incidents through a single case workspace.

Use this guide as a step-by-step walkthrough of common case operations.

Create Case

To create a case, access the Cases page from the sidebar, then click Create.

1. Fill the case information.

   

2. Click Create Case.

To edit a case, click the Edit icon in the cases table.

After opening a case, the following sections are available:

Upload New Triage Package

To upload a new triage package, open the case page and click Upload in Triage Packages.

Triage packages can be added in two ways:

• Compressed file (.zip or .tar.gz)
• Remote shared folder through SMB FTP SFTP NFS NextCloud, or similar sources

Upload Compressed ZIP File

1. Select the Compressed File tab.

   

2. Wait until upload finishes.

   

Share Triage Package Remotely

1. In the upload window, select the remote protocol (for example: SMB S3 FTP).

   

   Note

   Ensure there is network connectivity between the SandsBytes server and the remote machine. Also, make sure the provided credentials have permission to read from the specified remote share.

   Note

   It is not recommended to enable read/write on the remote mounted share to avoid any overwrite of evidence.

2. Submit and wait for the package to appear in the Triage Packages table.

   

The folder-bolt action in the table indicates how many remote shares are mounted for the package.

To activate or deactivate a remote share, click the folder-bolt action.

Browse Triage Packages

To browse uploaded packages, open the case page and select the Files tab.

The interface shows available packages and their contents regardless of storage location:

• Local files
• Mounted remote files (shown with a green folder icon)

The system also supports recursive browsing inside .zip archives without requiring extraction.

From the same interface, you can download or delete individual files.

Process Triage Package

Process selected triage packages to run parsers and extract structured records for investigation.

1. Select one or more packages in the Triage Packages table.

   

2. Click Process.

3. Select parsers to execute.

   

4. Click Submit.

5. Wait for processing to start.

   

6. Monitor progress values:

   Status	Description
   Pending	Files waiting in the queue to be processed.
   Running	Files currently being processed.
   Done	Files that finished processing successfully.
   Failed	Files that could not be processed successfully.
   Total	Total number of recognized files in the selected package(s).

List Processed Files

Use the Processed Files view to inspect parser outcomes, record counts, and file-level processing details.

1. Click a triage package in the Triage Packages table.

   

2. Review the Processed Files list, including:

   Field	Description
   Status	Pending, Running, Done, or Failed.
   Pushed records	Records parsed and pushed to the database.
   Failed records	Records processed but failed to be stored in the database (refer to the parser regarding such an issue).

   

   Note

   Processed files represent the file-parser pair. For example, if multiple parsers are executed on a single NTUSER.DAT file, that file appears multiple times with different parsers.

3. Click a row to open full file details, including the full stored path.

   

4. To upload files to an existing package, click the Upload action in the package Actions column.

   

5. To download files, select the target files and click Download. The browser downloads a compressed package containing the selected files.

   

Assign Members to the Case

Assign case members so they can collaborate on case tasks, requirements, findings, and related actions.

1. Open the case page.

2. In Assigned Members, click the + button.

   

3. Select a user to assign.

   

4. Confirm assignment.

To remove a user from the case, click the x button next to that member in Assigned Members.

Add Evidence to Case

Add evidence records to document collected artifacts such as images, dumps, captures, and related metadata.

1. Open the case page.

2. Open the Evidence tab.

3. Click Create.

   

4. Fill in the evidence information.

   

5. Click Create Evidence.

Add Case Requirement

Create requirements to track requests, dependencies, and obligations from internal or external stakeholders.

1. Open the case page.

2. Open the Requirements tab.

3. Click Create.

   

4. Fill in the requirement information.

   

5. Click Create Requirement.

Create Case Task and Assign to Member

Create tasks to organize investigation work and assign responsibilities to case members.

1. Open the case page.

2. Open the Tasks tab.

3. In the Kanban board, click Create from the phase column.

   

4. Fill task information, including assigned users.

   

   Note

   The assigned users field only displays members assigned to the case.

5. Save.

Create Case Project Timeline Event

Users can add custom events to the Case Project Timeline to capture milestones in the case lifecycle, such as case opening, request received, analysis start, and analysis end.

This feature improves auditability and supports accurate reconstruction of the case handling process.

Each event can include both start and end dates. If no end date is provided, the event is treated as a single-point milestone.

1. Open the case page.

2. Select the Case Timeline tab.

3. Click Create.

4. Fill event information and save.

   

To edit or delete an event, right-click the target event in the timeline chart and select the required action.

Create Case Finding

To manage analyst-confirmed findings related to attacker activities:

1. Open the case page.

2. Select the Findings tab.

3. Review findings in the timeline chart.

4. Click a finding in the chart to open details and associated IoCs.

   

5. Click Create to add a new finding.

   

6. Fill finding information and save.

   

Create IoC Associated with Finding

Add IoCs to a finding to capture forensic indicators linked to confirmed suspicious or malicious activity.

1. Open the finding page.

2. Select the target finding.

3. In finding details, click Create in the IoCs table.

   

4. Select IoC type (File, Network, or Account).

   

5. Fill in the IoC information and click Create.

List All IoCs in Case

Review all case IoCs in one place to validate indicators, compare types, and manage entries efficiently.

1. Open the case page.

2. Open the Findings tab.

3. In the IoCs table at the bottom, review all IoCs related to findings in the case.

   

   Note

   If an IoC exists in another case, a yellow badge appears beside it indicating how many other cases contain the same IoC.

4. To edit or delete an IoC, go to the Actions column.

   

Download IoCs

Export IoCs to CSV for sharing, offline review, or ingestion into other security tools.

1. Select the required IoC type tab.

2. Click Download.

   

3. Save the exported CSV.

Generate Case Report

Generate a structured case report from case data using predefined report templates.

Users can automatically generate case reports from information stored in the system. Reports use predefined templates in the CASE_REPORT category, which helps standardize documentation and reduce manual effort.

1. Open the case page.

2. Open the Reports tab.

   

3. Click Create.

4. Select the report template and report name (password is optional).

   

   Note

   The report name can use Jinja format. Refer to the Template Management section for more information about Jinja formatting.

5. Submit generation.

Download Case Report

Download generated reports for distribution, archival, and case documentation.

1. Open case reports from the Reports tab in the case page.

2. Find the target report.

3. Click Download.

   

   Note

   Refer to the Template Management section to customize generated report templates.

4. Save the file locally.