In the Cases page, drill down to the required case.
Click
format_list_bulleted
Case Actions on the top right of the page and select Incident from the menu.
Click Yes in the confirmation dialog box. The page refreshes and the new Incident now appears with the Incident icon in the cases list marked with the red critical sidebar. In addition, the case is automatically assigned to SOC Manager user or the user with SOC Manager role.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-13 UTC."],[[["You can mark a case as an incident within Google SecOps SOAR from the Cases page."],["To mark a case as an incident, select the \"Incident\" option from the \"Case Actions\" menu on the specific case page."],["Confirming the action will change the case to an incident, which will appear in the cases list with a red critical sidebar and an incident icon."],["Marking a case as an incident automatically assigns it to a user with the SOC Manager role."]]],[]]
