Configure Case Groups

Case Groups

If you want to read more about AbuseHQ’s Data Structure, we recommend the article: Understanding The AbuseHQ Data Structure

Configuring Case Groups

Access the settings menu AbuseHQ to configure Case Groups.

1. Click your name in the top right corner

2. Select Settings from the drop-down menu

3. On the left side of your screen, select Case Groups under Automation.

If this is your first time creating a Case Group, click the Add Case Group Button.

If this is not your first time creating a Case Group, click on the Define a new Case Group button.

Creating a new Case Group

1. Enter a name for the Case Group so you may identify it in the future.

2. Click the Rule button.

3. For Event Type, select Event, then Complainant.

4. Change is equal to does contain.

5. Leave the String as-is.

6. In the last field, add the complainant's name shadowserver

7. Next, select the Rule button again.

8. We will not change “Event Type,” “is equal,” or “the String.”

9. In the last field, add the type open-mongodb.

10. Next, select the playbook you created for this event type from the drop-down menu.

11. Finally, click on the Save button.

Deactivate, Archive, and Unarchive Case Groups

Case groups may be archived if they are disabled/deactivated. Only case groups without unresolved cases can be deleted. Archiving provides a way to hide deactivated case groups with unresolved cases. This will help keep your list of case groups clean.

To do this, follow these steps:

First, you will need to Deactivate the case group.

Next, you will want to click on the Archive button.

Once the case group is set to be archived, you can also unarchive it by clicking on the Unarchive button.

Finally, archived case groups can be viewed and unarchived again after toggling the Show archived case groups switch.