Manage cases

Latest Dynatrace

With Security Investigator, you can

  • Share your cases with other users in your Dynatrace environment
  • Download cases for archiving purposes
  • Upload cases from other sources as a starting point for a new investigation
  • Duplicate cases for reuse, backup, sharing, or access purposes

See below for details.

Share cases

You can share your cases with others in your Dynatrace environment.

Sharing options

You have three options:

  • Share access: Give access to specific users or groups to view or edit your case.

  • Share link: Create a link allowing anyone you share it with to view or edit your case.

    Be aware that distributed links can be forwarded to others and accessible with the same permissions as when they were created.

  • Share access and Share link: Combine sharing options. For example, you might want to maintain a list of people who need regular access to the case (collaboration and joint editing), and you might also want to occasionally send out an access link to a wider audience (people who only need to view the case).

To give access

  1. Open the case that you want to share.
  2. Select Share to open the Share case window.
  3. In the Share access section, specify the people and groups with whom you want to share the case, and select the permission level they should have.
  4. Select Share case.

To create sharing links

  1. Open the case that you want to share.
  2. Select Share to open the Share case window.
  3. In the Share link section, select a permission level and then select Create link. This creates a URL you can distribute in your investigation channel or include in your report for any link holder.

You can also share access and links without opening a case, for example, when you don't want to lock the case.

  1. On the main page of Security Investigator, select Cases.
  2. Select the menu for the respective case.
  3. Select Share.

Permissions

Regardless of how you share your case, you need to specify the permission level of your sharing:

  • Read-only: With the Can view option, people can view the case but can't edit anything. For example, they can't run queries, edit nodes, change timeframes, or add or delete elements in your evidence collection.

    In read-only mode, nodes refresh every few minutes, allowing you to stay updated with case changes.

  • Read and write: With the Can edit option, people can do anything the case owner can do except share or delete the case.

Locking a case

To provide integrity, multiple people are not allowed to edit a case at the same time. When someone is editing a case, it's locked into read-only mode for everyone with edit rights (including the case owner). It's released again when the case is closed by the person who locked it or after 10 minutes of inactivity.

Even when a case is locked in read-only mode, the case owner can still access and use the Share option.

View access

There are several ways to view the sharing state and permission level of a case:

  • On the main page of Security Investigator, in the lower-right corner of a case, there's a specific symbol for each state; hover over it for details.

    shared state

  • When expanding the Recent cases panel on the left-hand side of a case, the shared case symbol is displayed next to a case name; hover over it for details.

  • Within a case, next to the title name:

    • When the Share option is displayed, it means you own the case. To see and manage who you're sharing it with, see Manage access.
    • When the Share option isn't displayed, the case is shared with you in edit mode.
    • When Read-only Read-only is displayed, the case is shared with you in read-only mode.
    • When someone locks the case, you receive a notification indicating that the case is locked and who locked it.

Manage access

The share option provides you with a control panel where you can manage all access to your case.

  1. Open the case that you want to manage.

  2. Select Share.

    If you don't see a Share option at the top of the case, you don't own the case, so you can't access the share settings.

  3. Select Manage access , and then select any option you want.

In the Manage access section, you can

  • View a list of people or groups with access to your case and their permission level
  • Edit or remove permissions
  • View, copy, or remove links that you created with edit or view permissions
  • View how many times your links have been accessed
  • Remove all shared permissions for your case

Download and upload cases

You can download any case you have access to and continue your work in another Dynatrace environment or just store the case in another location to safeguard it.

To download a case, you have two options.

  1. On the main page of Security Investigator, select Cases.
  2. Select the menu for the respective case.
  3. Select Download.
  4. Select which case sections you want to download, then select Download.

To upload the case, on the main page of Security Investigator, select Upload.

Duplicate cases

You can duplicate any case you have access to. This creates a copy of the original within the same environment and can be helpful in various scenarios, such as:

  • Reuse: Start a new investigation from an older case while preserving the integrity of the original.

  • Backup: Create a snapshot of the investigation to prevent accidental data loss.

  • Share: Share the current state of your investigation with your peers so they can start their investigations based on your work.

  • Access: Start your investigation from a case to which you have read-only access, or edit a coworker's case without interfering with their investigation.

To duplicate a case you have two options.

  1. On the main page of Security Investigator, select Cases.
  2. Select the menu for the respective case.
  3. Select Duplicate.