Security incidents in cases

---
title: Security incidents in cases
description: In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/case-in-sir.html
release: australia
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Case creation from security artifacts, Security Case Management, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Security incidents in cases

In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.

-   **[Create a case from security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-cases-from-security-incidents.md)**  
In Security Incident Response, you can create cases from security incidents. After the security incidents have been used to create a new case, you can use Security Case Management to analyze the data.
-   **[Add security incidents to an existing case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/add-sec-inc-to-cases.md)**  
You can add security incidents to one or more existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.

**Parent Topic:**[Case creation from security artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/case-creation-from-security-artifacts.md)

**Related topics**  


[IoCs and observables in cases]()

[Configuration items in cases]()

[Affected users in cases]()