Cases

A case is an investigation case file. Findings tell you that something turned up; a case is where you work out what happened, why it matters and what to do about it.

Every case opens on its case board: a canvas where the evidence, the findings on it, your hypotheses and your notes sit side by side, joined by lines that say how they relate. You arrange it however the case makes sense to you, and the board keeps the picture for everyone who works on it.

The board above tells a short story. A payroll spreadsheet was transformed into a CSV export. The export was attached to an email, and the email went to a private address. Hypothesis H1 says the data was forwarded to a private mailbox, and two findings support it (the green lines). A note holds the next step, and a pink frame groups the exfiltration path.

What’s on a board

For a guided tour of the screen itself (the top bar, the tools and the side panels), see The case board. To move around quickly, see Navigating & shortcuts. For which tool to reach for when, see Use cases.

Starting a case

A case can start in three places, depending on where the work begins:

1. From an inquiry. Open a case straight from an inquiry. The inquiry becomes a watch that feeds the case, and its current matches arrive as starting evidence.
2. From a confirmed duplicate. In Duplicate review, turn a duplicate or similarity cluster into a case; its members arrive as evidence.
3. From scratch. Start a blank case, then add evidence from the board, or link one or more inquiries to seed it with their matches.

An empty board offers the three quickest ways in: Link a watch, Add evidence and Add a note.

Finding the cases that need you

The case list marks every case holding escalated findings with a ▲ n escalated badge next to its title, in the colour of high severity. Hover the badge for when the last escalation happened. An escalation also counts as a change to its case, so it moves up the list.

Status lifecycle

The status and the case’s severity are shown next to its name at the top of the board.

Letting Autopilot help

Each case has an AI mode that decides whether the Autopilot case agent may act on it on its own, or only watch and propose. Set it in the Case file panel on the board, where you can also start an Autopilot run straight away (Run Autopilot…, also in the board’s More menu).

What Autopilot proposes for a case arrives in the Leads panel, next to what the case finds by itself: documents that look like your evidence, important answers of its watches and similar findings. Drag a lead onto the board to add it where you want it, or accept or dismiss it from the list. See Leads. Everything Autopilot does on the case is recorded in the timeline with a clear AI badge. To freeze a sensitive case so that Autopilot only observes, see Steering & Fine-Tuning.

Closing a case

Close a case from the Case file panel or the board’s More menu (Close case…). Closing asks for a written conclusion: the answer the investigation reached. When you close it:

• its linked inquiries are archived, so they stop feeding it new matches;
• the conclusion is recorded in the timeline;
• a snapshot of the board is taken, so the picture at the moment of closing is kept exactly as it was;
• the board becomes read-only. A banner says so, with a Reopen button.

Go deeper