True Positive now lets you merge one case into another. This can be useful when:
- You realize two cases you're working on (say a phishing email and a malware outbreak) are actually part of the same attack.
- You're working on a large incident response engagement. You create a case for each live response analysis you do, then merge those cases into one central case for the engagement.
How it works
Merging a case into another simply marks the child case as "merged" and records which case it's merged into. This also means you can merge multiple cases into a case.
Merging a case does not modify the child case nor the parent case in any other way.
Form to fill out to merge a case
A case after merging it