Entering Case Attributes

Name

Display ID

An identification provided by an external tracking system. Automatically assigned when a new case is first saved.

Ticket Type

Drop-down list includes Internal, Client, and Incident types.

Stage

Indicate workflow stage of ticket; default selections include Queued, Initial, Follow-Up, Final, and Closed. See also Creating or Editing Stages.

• Queued - this is the default stage when the case is first created in ESM. Certain basic attributes are set here, such as the case name and one or more owners.
• Initial - once a case is assigned, the designated assignee changes the stage to this setting. It indicates that inspections have begun on this case. Other case attributes on other panels can now be set as applicable, such as Description and Security Classification.
• Follow-Up - the case is under active investigation.
• Final - the case is concluding.
• Closed - the investigation is over and the case is closed. No further work is needed on the case unless it is reopened (stage is changed). If you want to enter a reason for closure, see Using the Case's History Panel.

After the case editor UI is saved and closed, then viewed again, the stage setting is updated at the top of the edit panels.

Frequency

Indicates how often reported issue occurs. Values assigned are

• 0-0<1 (never or once)

• 1-1<10 (less than 10 times)

• 2-10>15 (10 to 15 times)

• 3-15 (15 times)

• 4-x>15 (more than 15)

Operational Impact

Impact of reported issue. Values assigned are

• 0-No Impact

• 1-No Immediate Impact

• 2-Low Priority Impact

• 3-High Priority Impact

• 4-Immediate Impact

Security Classification

Values assigned are

• 1-Unclassified

• 2-Confidential

• 3-Secret

• 4-Top Secret

After the case editor is saved and closed, then viewed again, the security classification setting is updated for the case's summary information, top of the edit panels.

Consequence Severity

Values assigned are

• 0-None

• 1-Insignificant

• 2-Marginal

• 3-Critical

• 4-Catastrophic

Reason for Closure

Values assigned are

• 0-False Positive

• 1-True Positive - Resolved

• 2-Duplicate

• 3-True Positive - Other

These values are placeholders for you to customize, if you want to use this field.

Refer to the Cases Editor UI Customization Tech Note. Familiarize yourself with the entire process of UI customization. Applicable information is covered in the topic, "Customizing Field Labels," specifically the procedure "To replace a list of string options."

Category of Situation

Default is 0-None. The value assigned is a placeholder for you to customize, if you want to use this field.

Refer to the Cases Editor UI Customization Tech Note. Familiarize yourself with the entire process of UI customization. Applicable information is covered in the topic, "Customizing Field Labels," specifically the procedure "To replace a list of string options."

Reporting level

System-calculated number calculated based on values entered in the previous fields that pertain to the particular case.

Detection Time

Automatically assigned based on the first event that is added to a case. Time is based on the Manager’s system time. After assignment, the value does not change even if you add events or remove existing events.

Estimated Start Time

Automatically assigned based on the Manager Receipt Time (MRT) of the oldest event attached to the case, even if more recent events have been added to the case prior to this oldest event. If you remove this oldest event from the case, Estimated Start Time takes the MRT of the next oldest event in the case, and so on. If you remove all events from the case, the field will be blank.

Estimated Restore Time

This is a user-entry field to denote the date when the case is resolved. Select a timestamp from the calendar popup.

Tip: Entering values in the Common section is optional. See Common Resource Attribute Fields for information.

Owner

The ESM user designated as owner of the case. In the resource selector, expand the user's group then select the user. Make sure the group has Write privilege to cases.

• The user's group is automatically added to Owner Groups after you click Apply or OK to save the change. This means the entire group also owns the case.

• As you add individual users as owners, their groups will also be added as owners if those groups are not yet owners. Owners are displayed at the top of the edit panel, below the editor icons. If the list is too long, try resizing the edit panel to make the list readable.

• If the individual owner linked to multiple groups, those linked groups are also automatically added to Owner Groups.

• Owners are identified at the top area of the case editor.

Note: If non-ESM administrators display the case editor, they will see the owner(s), but not owner groups.

See also the description of the Owner Groups field (below) to know how entries in this field are automatically affected by group owner designations.

Owner Groups

The user group designated as a collective owner of the case. The group must have Write privilege to cases. You can specify groups as owners without specifying individual users. Group inheritance is not supported in case ownership. Make sure you specify a user subgroup with members. Repeat as required.

Note: If non-ESM administrators display the case editor, they will not see the owner groups. The field is empty even if it has a value.

See also the description for the Owner field (above) to know how entries in this field are automatically affected by individual owner designations.

Notification Groups

One or more notification groups to be notified about the case.

Note: If you see an attribute called External Ticket, this means ESM is integrated with an external case management system. Refer to Using External Case Management Systems.