Case management
Case management is the part of a SOAR where an incident becomes a record with fields, an owner, notes, links to related incidents and a history. It is where analysts work together. Products differ on whether it is built in, sold as an add-on or left to an ITSM tool.
What Case management means
A case holds evidence and decisions, so it is also the audit record. When you move platforms, the case history is often worth more than the playbooks.
Case data and playbook logic move on different roads. A library story or export tool may carry cases and say nothing about logic.
Case management in ServiceNow Security Operations's own words
ServiceNow's Q1 2026 release adds bulk linking of incidents to a parent, read-only sharing of incidents with external parties and MITRE D3FEND suggestions in the incident workspace. ServiceNow Security Operations documentation, read 2026-11-03