Open the Case Details View | LogRhythm Documentation

To open the Case Details view to see an expanded layout for managing cases:

Do one of the following:
- On the top navigation bar, click Threat Center, and then click Cases. Scroll through the case widgets as necessary until you locate the case that you want to view.
- In the Current Case panel, click the Current Case list and select the case that you want to view.
- In the Inspector panel of the case you selected, click Go to Case.
On the Case card, click the case name. The Case Details view opens.
The Case Details view provides the following information for the selected case:

To return to the main Cases page, click the back button on your browser or click Threat Center and then Cases on the top navigation bar.

Information	Description
Collaborators	Lists the case owner and any other collaborators. For more information, see Case Collaborators.
Tags	Lists any tags that have been added to the case. For more information, see Case Tags.
Associated Cases	Contains the cards of any associated cases. For more information, see Case Associations.
Evidence	Contains any logs, notes, alarms, or other uploaded files that have been entered as evidence in the case.
Metrics	Shows important dates in the case and uses those dates to automatically calculate metrics. For incidents, Time to Detect and Time to Respond are calculated. For cases, Time to Qualify and Time to Investigate are calculated. For more information, see Case Status and Workflow. Time to Detect is the difference between the date and time the earliest evidence for the case became available and the date and time the case was created. The Web Console automatically populates the Earliest Evidence in Case date based on the evidence that has been added to the case, but you can edit the field manually. This field is not applicable to cases that are never escalated to incident status. Time to Respond is the difference between the date and time the case was created and the date and time it was mitigated. This field is not applicable to cases that are never escalated to incident status. Time to Qualify is the difference between the date and time the earliest evidence for the case became available and the date and time the case was created. This is equal to the Time to Detect for incidents. Time to Investigate is the difference between the date and time a non-incident case was created and the date and time it was completed.
History	Provides a description of all actions taken on the case from the time it was created.