Each case has it's own page acting as a main workspace for investigating complex situations involving multiple alerts, persons, or transactions. Cases follow a familiar structure similar to alerts, with statuses, assignees, notes, and files, additionally allowing you to link multiple alerts or entities into a single investigation.
Case details
At the top of the page, the Case details section shows the main information about the investigation - its name, description, and rationale. These fields are used to explain why the case was created and provide context for the investigation. They can be edited if the investigation scope changes.
Case assignee, notes and files
Cases support assignees, notes, and file attachments to help track ownership, document investigation progress, and store supporting evidence.
These features work the same way as they do for alerts in Salv. For more details on how to use them, you can check out the manual alert page article.
π Currently, note templates are not supported in cases.
Case status
Each case has a status assigned to it, which can be updated manually as the investigation progresses. Available statuses:
New
In progress
Pending
Escalated
Closed as false positive
Closed as true positive
Reported
Updating a case status
You can update the status directly from the case page using the status menu. After selecting a new status, you'll be prompted to add a note. You can also select a status while you are writing a note.
β οΈ Unlike alert statuses, case statuses are not customisable at this time and they don't support quick status notes. If you have specific status requirements for your workflows, let us know - we're open to exploring it.
π‘ Case statuses do not affect the statuses of any attached alerts or persons, nor do they influence person risk level, or decision rules.
Attaching persons, transactions and alerts
Cases allow you to attach persons, transactions and counterparties involved in an investigation. This helps collect all relevant activity and entities in one place.
Limit: currently a case can include up to 100 persons and 100 transactions.
Attach persons or transactions from case page
To attach a person or transaction from the case page, click Attach Persons or Attach Transactions. You will be redirected to the entity search page, where you can find the relevant records. After selecting the entities you want to include, click Attach to add them to the case.
Once attached, the persons or transactions will appear in their respective sections on the case page and can be opened directly from there.
Attach alerts from case page
To attach alerts from the case page, click Attach Alerts.
In the attachment window, first select the alert type, then enter the Alert IDs of the alerts you want to attach. After entering the IDs, click Attach to add them to the case.
Only one alert type can be added at a time. However, a case can contain multiple alert types overall, so additional alerts can be attached by repeating the process for other alert types.
Once attached, the alerts will appear in the Alerts section of the case page and can be opened directly from there.
π‘ Tip: Attaching alerts directly from the alert page is usually faster, as the alert is already selected. The next section explains how to add alerts to a case from an alert page.
Attach from entity or alert page
Persons and transactions can also be attached to a case directly from their respective pages. While reviewing a person, transaction, or counterparty, you can add that entity to an existing case without leaving the page.
Detach from case
If an entity was added by mistake or is no longer relevant to the investigation, it can be detached from the case - click on the person or transaction selector and click Detach.






