<h2>Configuration items in cases</h2><br/><div style="overflow-x:auto"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta content="text/html; charset=UTF-8" /><meta name="copyright" content="(C) Copyright 2024" /><meta name="DC.rights.owner" content="(C) Copyright 2024" /><meta name="generator" content="DITA-OT" /><meta name="DC.type" content="concept" /><meta name="DC.title" content="Configuration items in cases" /><meta name="abstract" content="You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases." /><meta name="description" content="You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases." /><meta name="DC.subject" content="Cases from configuration items" /><meta name="keywords" content="Cases from configuration items" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/concept/case-creation-from-security-artifacts.html" /><meta name="DC.relation" scheme="URI" content="../../../product/security-operations/concept/security-operations-intro.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence/reference/threat-intel-landing-page.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/concept/case-mgmt.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/concept/cases-in-threat.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/concept/case-in-sir.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/concept/cases-from-affected-users.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/task/create-cases-from-CIs.html" /><meta name="DC.relation" scheme="URI" content="../../../product/threat-intelligence-case-management/task/add-cis-to-cases-sir.html" /><meta name="DC.creator" content="ServiceNow" /><meta name="DC.date.created" content="2022-08-04" /><meta name="DC.date.modified" content="2022-08-04" /><meta name="DC.format" content="XHTML" /><meta name="DC.identifier" content="cases-from-cis" /><link rel="stylesheet" type="text/css" href="../../../CSS/commonltr.css" /><title>Configuration items in cases</title></head><body id="cases-from-cis"> <div class="breadcrumb"><a class="link" href="../../../product/security-operations/concept/security-operations-intro.html" title="ServiceNow Security Operations brings incident data from your security tools into a structured response engine that uses intelligent workflows, automation, and a deep connection with IT to prioritize and resolve threats based on the impact they pose to your organization.">Security Operations</a> > <a class="link" href="../../../product/threat-intelligence/reference/threat-intel-landing-page.html" title="The ServiceNow Threat Intelligence application allows you to find indicators of compromise (IoC) and enrich security incidents with threat intelligence data.">Threat Intelligence</a> > <a class="link" href="../../../product/threat-intelligence-case-management/concept/case-mgmt.html" title="Security Case Management provides a means for security analysts who are engaged in threat hunting to gather information on suspicious activity in their environment. Case-related records, such as security incidents, observables, CIs, and affected users can be added to cases to accommodate broad and specific analysis.">Security Case Management</a> > </div> <h1 class="title topictitle1" id="ariaid-title1">Configuration items in cases</h1> <div class="body conbody"><p class="shortdesc">You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.</p> </div> <div class="related-links"> <ul class="ullinks"><li class="link ulchildlink"><strong><a href="../../../product/threat-intelligence-case-management/task/create-cases-from-CIs.html">Create a case from CIs</a></strong><br /> You can create a security case from configuration items in the Configuration Item [cmdb_ci] table. After the CIs have been used to create a new case, you can use <span class="ph">Security Case Management</span> to analyze the data.</li><li class="link ulchildlink"><strong><a href="../../../product/threat-intelligence-case-management/task/add-cis-to-cases-sir.html">Add CIs to existing cases</a></strong><br /> You can add configuration items to one or more existing cases. After the CIs have been added to cases, you can use <span class="ph">Security Case Management</span> to analyze the data.</li></ul> <div class="familylinks"> <div class="parentlink"><strong>Parent Topic:</strong> <a class="link" href="../../../product/threat-intelligence-case-management/concept/case-creation-from-security-artifacts.html" title="In addition to creating cases manually from Security Case Management, you can also create cases from security artifacts, such as security incidents, indicators of compromise, affected users, and configuration items.">Case creation from security artifacts</a></div> </div> <div class="linklist relinfo relconcepts"><strong>Related concepts</strong><br /> <ul class="linklist"><li class="linklist"><a class="link" href="../../../product/threat-intelligence-case-management/concept/cases-in-threat.html" title="In Threat Intelligence, you can create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You can also create observables directly from a case.">IoCs and observables in cases</a></li><li class="linklist"><a class="link" href="../../../product/threat-intelligence-case-management/concept/case-in-sir.html" title="In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.">Security incidents in cases</a></li><li class="linklist"><a class="link" href="../../../product/threat-intelligence-case-management/concept/cases-from-affected-users.html" title="You can create a new case from one or more affected users in the User [sys_user] table. You can also add users to existing cases.">Affected users in cases</a></li></ul></div> </div></body></html></div>