Linking an existing case from Investigation Canvas

task australia Updated Sep 10, 2026 1 min read tisc-link-existing-case-canvas.md

Raw file servicenow.com

Use this section to link an existing case from the investigation canvas.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Select Threat Analyst Workbench icon.
Go to Case Management > All Cases.

This displays all the cases.
Select Case Management > All Cases
Open any case record from the list view.
Select Link Case from the Details section.

The Link a Case dialogue box appears.
Select a case ID from the list to associate the case to an investigation canvas.

[Omitted image "tisc-link-an-existing-case-from-canvas.png"] Alt text: Link an existing case from investigation canvas.

A confirmation message is displayed confirming that the case is linked successfully.

Note: In case if no case is available for linking to the Investigation Canvas, you can create a new case to initiate and organize your investigation context. For more information on how to create a new case, see Creating a Case and Linking from Investigation Canvas

.
To remove a linked case, select the Unlink button.

Parent Topic:Working with Investigation Canvas

Related topics

Creating an investigation canvas

Keywords link existing caseinvestigation canvasunlink casecase management

62 lines · 2.5 KB Wrap lines

---
title: Linking an existing case from Investigation Canvas
description: Use this section to link an existing case from the investigation canvas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-link-existing-case-canvas.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [link existing case, investigation canvas, unlink case, case management]
breadcrumb: [Working with Investigation Canvas, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Linking an existing case from Investigation Canvas

Use this section to link an existing case from the investigation canvas.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1. Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2. Select **Threat Analyst Workbench** icon.

3. Go to **Case Management** &gt; **All Cases**.

This displays all the cases.

4. Select **Case Management** &gt; **All Cases**

5. Open any case record from the list view.

6. Select **Link Case** from the **Details** section.

The Link a Case dialogue box appears.

7. Select a case ID from the list to associate the case to an investigation canvas.

\[Omitted image "tisc-link-an-existing-case-from-canvas.png"\] Alt text: Link an existing case from investigation canvas.

A confirmation message is displayed confirming that the case is linked successfully.

**Note:** In case if no case is available for linking to the Investigation Canvas, you can create a new case to initiate and organize your investigation context. For more information on how to create a new case, see [Creating a Case and Linking from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-link-case.md)

8. To remove a linked case, select the **Unlink** button.

**Parent Topic:**[Working with Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-investigation-canvases.md)

**Related topics**

[Creating an investigation canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-canvas.md)