Case Report

To run a report involving Cases, take the following steps:

1. Go to CMDB > CMDB Reports.
2. Select a folder and click New.
3. In Step 1: General, take the following steps:
   1. In the Report Name field, enter the name of the report.
   2. In the Description field, enter a description, such as the purpose of the report, or what it provides.
   3. From the Target drop-down list, select CASE.
4. Click Step 2: Define Condition, and take the following steps:
   1. Under Attribute, select a case attribute.
   2. Under Operator, select an operator.
   3. Under Value, select/enter a value.
   4. Click + to add a new row for additional conditions, and repeat 4a.-4c..
5. Click Step 3: Define Display Column, and select the Case Attributes to display.
6. Click Save.
7. With the case report selected, click Run.

The following Case Attributes are available. For more information, see Case Attributes.

• Age: This new attribute specifies the difference between Current Time and Case Assignment Time.
• Assigned: The time when the Case was assigned to a user.
• Assignee: The person currently assigned to handle the case.
• Case Entity: Same as Case Assets.
• Case ID: Unique ID of the Case.
• Case Title: Case Title describing the Case.
• Close Code: A Code that indicates how the Case was resolved.
• Closed: The time when the Case was closed.
• Created: The time when the Case was created.
• Creator: The person or entity (system) that created the case.
• Customer ID: FortiSIEM Organization ID (for Service Provider deployments).
• Customer Name: FortiSIEM Organization name (for Service Provider deployments).
• Due: The time by which the Case is expected to be resolved.
• Incident IDs: Comma separate list of IDs of Incidents included in the Case.
• Resolution Time: The time duration it took to resolve the Case
• Rule Name: List of rule names associated with Incidents included in the Case
• Severity: Case Severity indicates relative Case prioritization.
• Stage: Case Stage specifies Incident Response stage.
• State: Same as Case Status, indicates the current progress on the Case.

For the following Case Attributes, you need to use the numerical values in Step 2: Define Condition:, e.g. Severity = 0 to get Critical Cases, Case State = 5 to get OverDue Cases, etc.

Case Attribute	String Value	Numerical value
Case Stage	Detection	0
	Analysis	1
	Containment	2
	Eradication	3
	Recovery	4
	LessonLearned	5
Case State	New	0
	Assigned	1
	Closed	2
	In Progress	3
	OverDue	5
	Unassigned	6
	Pending Customer Feedback	7
	Received Customer Feedback	8
Close Code	Automatic-FSM-TP	0
	Automatic-FSM-FP	1
	Manual-Analyst-TP	2
	Manual-Analyst-FP	3
Severity	Critical	0
	High	1
	Medium	2
	Low	3