2. What is a case?

• A case is an investigation project

• A case groups the investigation data you are going to analyze

• It's up to you how many cases you create:

  • By investigation

  • By host within an investigation

• Factors:

  • Only one case can be open at a time

  • Reporting is done at a case-level

  • Cases are saved automatically -- there is no "save" feature