Add Alarms to a Case | LogRhythm Documentation

You can add alarms to a case one at a time or you can select multiple alarms to add to a case at once.

When alarms are added to case evidence, they can then be managed from their alarm cards in the evidence panels in the same way that they can be managed from the Alarms page. You can open and close them, view their metadata, add comments to them, and so forth. For more information on working with alarms, see Alarms.

When more than 10 alarms are added to a case, a link displays in the evidence section of the Current Case panel or Case details page to open all alarms in an alarms page.

On the navigation bar, click Threat Center, and then click Alarms.
On the left side of the dashboard layout, click the Current Case tab.
In the Current Case panel, select the case you want to modify from the Current Case list.
Do one of the following:

Action	Description
Add a single alarm to a case from the Alarm card view	Scroll through the alarms as needed until you locate the one that you want to add. Do one of the following: Inside the Alarm card, click the Add to Case icon, and then click Add to Current Case. Select the check box in the upper-right corner of the Alarm card, click the Add to Case icon in the bulk action bar, and then click Add to Current Case. The alarm is added to the case as evidence and a blue Alarm Added to Case icon appears on the case card. The number next to the icon denotes the number of cases to which the alarm has been added.
Add a single alarm to a case from the Alarm grid view	Scroll through the alarms as needed until you locate the one that you want to add. Do one of the following: In the Actions column, click the Add to Case icon, and then click Add to Current Case. In the Actions column for the alarm you want, select the check box, click the Add to Case icon in the bulk action bar, and then click Add to Current Case. The alarm is added to the case as evidence and a number appears next to the Add to Case icon in the Actions column. The number denotes the number of cases to which the alarm has been added.
Add a single alarm to a case in the Inspector panel in the Alarm card view	Scroll through the alarms as needed until you locate the one that you want to add. Click on the alarm name in the Alarm card to select it and open the Inspector panel. In the Alarm Actions section, click the Add to Case list. Scroll through the list or use the typeahead filter to find a case. Click Add.
Add a single alarm to a case in the Inspector panel in the Alarm grid view	Scroll through the alarms as needed until you locate the one that you want to add. Click anywhere in the row of the alarm to select it. Click the Inspector tab to expand the Inspector panel, if necessary. In the Alarm Actions section, click the Add to Case list. Scroll through the list or use the typeahead filter to find a case. Click Add.
Add multiple alarms to a case in the Alarm card view	Select the check box in the upper-right corner of each of the alarms that you want to add to the case. If you want to select all visible alarms on the dashboard, you can click Select Visible from the Alarms toolbar. On the bulk action bar, click the Add to Case icon, and then click Add to Current Case. The selected alarms are added to the case as evidence.
Add multiple alarms to a case in the Alarm grid view	Select the check box in the Actions column for each alarm you want to add to the case. If you want to select the first 100 alarms that meet the active filter criteria, you can select Check All at the top of the Actions column. On the bulk action bar, click the Add to Case icon, and then click Add to Current Case. The selected alarms are added to the case as evidence.