Case Groups

If you want to read more about AbuseHQ’s Data Structure, we recommend the following article: Understanding The AbuseHQ Data Structure

You will need to access the Settings menu within AbuseHQ to configure Case Groups.

To do this, follow these steps:

1. Click your name in the top right corner

2. Select Settings from the drop-down menu

3. On the left side of your screen, you will want to select Case Groups under Automation.

If this is your first time creating a Case Group, you will want to click on the Add Case Group Button.

If this is not your first time creating a Case Group, you will want to click on the Define a new Case Group button.

Creating a new Case Group

1. Enter a name for this Case Group. This should be something that will help you to identify this one apart from future Case Groups.

2. Click the Rule Button.

3. For Event Type select Event then Complainant.

4. Change is equal to does contain.

5. Leave the String as-is.

6. In the last field, add the complainant's name shadowserver

7. Next, select the Rule button again.

8. We will not change “Event Type”, “is equal”, or “the String”.

9. In the last field, add the type open-mongodb.

10. Next, select the playbook you created for this event type from the drop-down menu.

11. Finally, click on the Save button.

Deactivate, Archive and Unarchive Case Groups

Case groups can be archived if they are disabled/deactivated. Only case groups without unresolved cases can be deleted. Archiving provides a way to hide deactivated case groups with unresolved cases. This should help to keep your case groups clean.

To do this, follow these steps:

First, you will need to Deactivate the case group.

Next, you will want to click on the Archive button.

Once the case group is set to be archived, you can also unarchive it by clicking on the Unarchive button.

Finally, archived case groups can be viewed and unarchived again after toggling the Show archived case groups switch.