Steps to Update Case Escalation from 6.x-7.1.x to 7.2.x

If you had an existing case escalation policy prior to FortiSIEM 7.2.0 or later, you must take the following steps for these old cases/case users to work with FortiSIEM 7.2.0 or later.

• Step 1 - Move or Create Prior Case Users to FortiAnalysts Groups
• Step 2 - Update your Escalation Policy (now called a Case Management Policy)
• Step 3 - Associate Case Management Policy with an Automation Policy

Step 1 - Move or Create Prior Case Users to FortiAnalysts Groups

If you have any users involved with cases prior to FortiSIEM 7.2.0 or later that you wish to use, you will need to move these users so they are in a group under FortiSIEM Analysts in CMDB. The general steps to create a group and move users are provided:

1. Navigate to CMDB > Users.
2. Expand Users.
3. Select FortiSIEM Analysts.
4. In the left upper pane, click+ to create a folder/group.
5. In the Group field, enter a name.
6. Use the GUI to move prior case user(s) to a FortiSIEM Analysts group.
   Note: Remember to update these users so they have a Work Schedule, and if you wish to designate a user as a Team Lead, to select the Team Lead checkbox during your update for that user. For more information, see here.
   
7. Click Save.

Step 2 - Update your Escalation Policy (now called a Case Management Policy)

1. Navigate to Admin > Settings > General > Case Management.
2. Select your Case Management Policy and click Edit.
3. Update your settings appropriately depending on whether to plan to handle cases manually or through an automation policy.
   • For manual case management, configure everything except the Auto-assignment section.
     More information about configuration is available here.
   • For automation, configure the entire case management policy.
     More information about configuration is available here.
4. Click Save.

Step 3 - Associate Case Management Policy with an Automation Policy

Automation policy provides fine grained control over the set of Incidents for which Cases will be created.

The following Incident attributes can be chosen to determine if a Case needs to be created:

• Incident Severity
• Specific Rules or Rule Groups
• Time Range
• Affected Items in Incident Source And Target
• Affected Orgs (Service Provider Case)

For FortiSIEM to automatically find an Assignee and then manage the Case, you need to specify:

1. A Case Management Policy
2. An ordered list of FortiSIEM Analyst Teams to work on the Case. FortiSIEM will try to find users within the Teams in the specified order.

You can create multiple policies and arrange them using Policy Rank. Lower Ranks appear first in the list and are evaluated first. The First matched Policy is chosen to create and manage the Case for that Incident.

To create an Automation Policy:

1. Go to Admin > Settings > General > Automation Policy.
2. Click New.
3. Enter the following Incident attributes:
   1. In the Name field, enter the name of the policy.
   2. From the Severity checkboxes, select the Incident Severities.
   3. From Rules, click ‚, then use the arrow buttons and select the Rule Groups or individual rules. When done, click Save. If you do not choose anything, then the default choice is ANY (meaning ALL Rules).
   4. From Time Range, click ‚, select Define Time Range, then use the GUI to configure your time range. When done, click Save. If you do not choose anything, then the default choice is ANY (meaning ALL Time Ranges).
   5. From Affected Items, click ‚ to specify specific devices and/or IP ranges. Click Select Device to configure specific devices using the GUI. Click Add IP/Range to configure an IP address or IP Range. When done, click Save. If you do not choose anything then the default choice is ANY (meaning ALL Affected Items).
   6. From Affected Orgs, click ‚ and use the GUI to select the Affected Organizations for your Service Provider deployment. When done, click Save. If you do not choose anything then the default choice is ANY (meaning ALL Organizations).
   7. For Action: check the Create Case when an incident is created checkbox and click on . Then
      1. From the Case Management Policy drop-down list, select a Case Management Policy.
      2. From the Teams FIRST drop-down list, select the FortiSIEM Analyst Team that will first handle the case. Then select + and choose the next FortiSIEM Analyst Team from the THEN drop-down list that will handle the Case if no one from the first Team is found. Click + and select another FortiSIEM Analyst Team as needed.
      3. Click Save when finished with selecting Teams.
   8. Click Save.
4. You can change the order of evaluation by selecting a Policy and clicking the Up or Down buttons.
5. Click a policy's Enabled checkbox to enable that policy and its rules.

Detailed steps for creating an Automation Policy can be found here.