Creating a Case and Linking from Investigation Canvas

task brazil Updated Sep 10, 2026 1 min read tisc-link-case.md

Use this section to create and link a case(s) from an investigation canvas.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Select Threat Analyst Workbench icon.
Go to Case Management > All Cases.

This displays all the cases.
Open any case record from the list.
Select Link Case from the Details section.

The Create and Link Case dialogue box appears.
Select a case from the list to associate the case to an investigation canvas.
Select Create New Canvas.

The Create New Case dialogue box appears.
Fill in the form fields, as appropriate.

Field	Description
Case ID	A unique identifier for the case. This is system generated ID.
Short description	Summary of the request or issue that is being investigated or a short description.
Case Type	Select the type of case being investigated. The possible options for the investigation are:- Threat Hunting Request for Information Vulnerability Management Case Compliance Case Incident Response Case Collaboration Case Others
Priority	Indicates the priority of a case.
Assignment group	The assigned group responsible for working on the case.
Status	The current status of the case.
Assigned to	The analyst who is responsible for working on a case.

9. Select **Create and Link** to create a new case and link it directly to the investigation canvas.

A confirmation is displayed confirming that the case is created and linked to the investigation canvas successfully.

**Note:** This option is useful when no existing case is associated with the investigation canvas.

To remove a linked case, select the Unlink button.

For more information on how to directly link an existing case to the investigation canvas, see Linking an existing case from Investigation Canvas.

Parent Topic:Working with Investigation Canvas

Related topics

Creating an investigation canvas

Keywords create caselink caseinvestigation canvascase management

138 lines · 3.5 KB Wrap lines

---
title: Creating a Case and Linking from Investigation Canvas
description: Use this section to create and link a case\(s\) from an investigation canvas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/tisc-link-case.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [create case, link case, investigation canvas, case management]
breadcrumb: [Working with Investigation Canvas, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Creating a Case and Linking from Investigation Canvas

Use this section to create and link a case\(s\) from an investigation canvas.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2.  Select **Threat Analyst Workbench** icon.

3.  Go to **Case Management** &gt; **All Cases**.

    This displays all the cases.

4.  Open any case record from the list.

5.  Select **Link Case** from the **Details** section.

    The Create and Link Case dialogue box appears.

6.  Select a case from the list to associate the case to an investigation canvas.

7.  Select **Create New Canvas**.

    The Create New Case dialogue box appears.

8.  Fill in the form fields, as appropriate.

<table id="table_fkk_wc1_zfc"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Case ID

</td><td>

A unique identifier for the case. This is system generated ID.

</td></tr><tr><td>

Short description

</td><td>

Summary of the request or issue that is being investigated or a short description.

</td></tr><tr><td>

Case Type

</td><td>

Select the type of case being investigated. The possible options for the investigation are:-   Threat Hunting
-   Request for Information
-   Vulnerability Management Case
-   Compliance Case
-   Incident Response Case
-   Collaboration Case
-   Others


</td></tr><tr><td>

Priority

</td><td>

Indicates the priority of a case.

</td></tr><tr><td>

Assignment group

</td><td>

The assigned group responsible for working on the case.

</td></tr><tr><td>

Status

</td><td>

The current status of the case.

</td></tr><tr><td>

Assigned to

</td><td>

The analyst who is responsible for working on a case.

</td></tr></tbody>
</table>9.  Select **Create and Link** to create a new case and link it directly to the investigation canvas.

    A confirmation is displayed confirming that the case is created and linked to the investigation canvas successfully.

    **Note:** This option is useful when no existing case is associated with the investigation canvas.

10. To remove a linked case, select the **Unlink** button.

    For more information on how to directly link an existing case to the investigation canvas, see [Linking an existing case from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-link-existing-case-canvas.md).


**Parent Topic:**[Working with Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-investigation-canvases.md)

**Related topics**  


[Creating an investigation canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-create-canvas.md)