Quick Start Basics
The table lists the main things you can do in ICM. These tasks might vary depending on your business process.
Task | Action |
---|---|
Start a new investigation or case |
Create a case to start a new investigation or create an incident report to record any activities that might require further investigation. See Creating cases or Create an Information or Incident Report. A case is used as a container to hold information about an investigation. Your business unit may use different terminology. |
Record information in an existing investigation or case |
Create a case note to record these activities. See Add a case note. ICM uses case notes to record the activities that took place during an investigation, information gathered, and what was discovered as a result. |
Record a reported or observed incident that might be investigated |
Create an incident report to record any activities that might require investigation. |
Record information that isn't related to any current investigation or case |
Create an information report to record miscellaneous information that isn't related to a current investigation or case. |
Assign work |
Create a task from a case, case note, information report, or task result to assign work. You can use the Tasks feature to assign work to users. See Creating a Task. |
Record information about a person, address, phone number, and more |
Open a source entity and create an entity. Entities are used to record information about real world items like people, addresses, and phone numbers. You can only create entities in a case note, information report, task, or task result. See Adding Entities to Source Entities. |
Record links between entities |
Open a source entity and record a relationship (or link) between entities. You can create entity relationships in case notes, information reports, tasks, or task results. |
Record images of entities |
Open an entity and upload an image to associate it with the entity. An image is saved as an image entity. One image can be related to several entities. |
Record information that relates to a different time zone |
Select the time zone icon beside the date or time control in which you want to record information from another time zone. See Time Zones. |
Search for Information |
Search entity types, cases, case notes, information reports, and specific entity types for the information you need. See Searching. |
Receive an alert when another user updates or looks at an entity |
Place a watch on any entity. When a user interacts with the entity in a particular way, you receive an alert. See Watches. |
Combine information |
Use any of these methods to collate intelligence:
See Diagrams. |