Cases

Alerts from your SIEMs are clustered into cases: alerts with the same rule, source and asset within 15 minutes become one case. Garrison enriches each case and can draft an analysis. You set the verdict.

The queue

Tabs: Active (everything not closed), Open, In review, Escalated, Closed. Filter by severity and verdict, search by reference, title, IP, asset or user, or show only cases assigned to you.

Each row shows severity and priority, the case reference, title, the backlog age, alert count, source IP, asset, age, verdict, status and assignee. The coloured bar at the left is the severity.

The queue works from the keyboard: j/k move, Enter opens, x selects, 1–5 set the verdict (benign, policy violation, suspicious, confirmed, inconclusive), a assigns to you, e escalates, c closes, / searches.

A case

Part
Header	Severity and priority, status, the SIEM and rule, alert count
SLA	SLA start → Acknowledged → Triaged → Closed, with MTTA and MTTR
Status and verdict	Set the status, Assign to me, set the verdict
Analysis	Draft analysis asks the AI for a summary, a suggested verdict and next steps, drawn from the alert fields and the enrichment. Enrich re-runs enrichment
Context	Source IP, asset, user, first and last seen
Enrichment	Asset context (crown jewels raise priority), whether this indicator was seen before, related cases
Timeline	Every event: created, more alerts, enrichment, escalations, changes
Propose action	Containment on a connected device, such as blocking the source IP. It becomes an approval
Ask Garry about this case	Opens a chat with the case as context

Escalation

Escalation policies (Settings → Escalation) notify people when cases go unhandled: by default, high and critical cases on arrival, and cases with priority 60+ after 30 and 60 minutes. Each policy has a per-case throttle and optional quiet hours. Escalations appear on the case timeline and in notifications.

Closing a case in Garrison does not close the alarm in the SIEM.