Affected users in cases

---
title: Affected users in cases
description: You can create a new case from one or more affected users in the User \[sys\_user\] table. You can also add users to existing cases.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/cases-from-affected-users.html
release: australia
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Case creation from security artifacts, Security Case Management, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Affected users in cases

You can create a new case from one or more affected users in the User \[sys\_user\] table. You can also add users to existing cases.

-   **[Create a case from affected users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-cases-from-affected-users.md)**  
You can create a security case from affected users in the User \[sys\_user\] table. After the affected users have been used to create a new case, you can use Security Case Management to analyze the data.
-   **[Add affected users to existing cases](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/add-users-to-cases-sir.md)**  
You can add affected users to one or more existing cases. After the user records have been added to cases, you can use Security Case Management to analyze the data.

**Parent Topic:**[Case creation from security artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/case-creation-from-security-artifacts.md)

**Related topics**  


[IoCs and observables in cases]()

[Security incidents in cases]()

[Configuration items in cases]()