Cases and evidence export

A flag is something a rule, a reviewer or a person thought worth a look. Most flags are noise, and you resolve them with what they were. The ones that are real become a case: one owner, the evidence in one place, a clock from detection to containment, and a record of every decision that you can export and check without trusting Golem.

Every triage decision, case event and export is signed into your workspace's evidence chain, the same way your agents' calls are signed into theirs. See The signed record.

Triage a flag#

Flags wait under Watch → Alerts. Filter by severity (Suspicious, Dangerous, Malicious), by Review required, or group them by Source to see which rule or reader raised them.

For each flag, do one of two things:

• Resolve it with what it was:

  Disposition	When to use it
  False positive	The source got it wrong. Counts against that source's accuracy.
  Expected activity	It happened as described, but it was allowed. A candidate for an exception.
  Couldn't tell	Not enough to decide. Counts neither way.

  A note is optional, up to 1,000 characters.

• Escalate it into a case if it is real, by opening a new case or adding it to an existing one.

Select several flags to resolve or escalate them together. A source's card offers Resolve all from this source when one rule is clearly misfiring, and shows how its flags were resolved so far. Only people's dispositions count toward a source's accuracy, not an agent's.

A flag can be in one case at a time. A flag that is in a case closes when the case does, so it cannot be resolved separately from Alerts.

Cases#

Open a case by escalating flags, or with Add to case from an event, a conversation, an inventory item or a machine. You can link flags, conversations, sessions, machines, inventory items and single events.

The assignee, anyone marked Working on it, and workspace owners and admins can change a case. Anyone else can Watch it. Nothing in a case is ever deleted: its events and comments are append-only, and removing a flag sends it back to Alerts with that removal recorded.

Several cases about the same incident can be gathered under one with Condense into one case. Closing that parent closes every open child with the same disposition, and reportability is decided once, on the parent.

Set who gets new cases under Cases → Settings, as the Default assignee. Without one, an agent cannot open a case.

The clock#

Every case shows how long each step took after detection:

A corrected time cannot be in the future or before detection, keeps the old value on the timeline, and can only be set by a person.

Marking evidence#

On a case's Evidence tab, or turn by turn in its Investigate tab, mark each item Bad, Suspicious, Context or Benign, with an optional confidence and note. Marking an item adds it to the case if it was not there. Bad and suspicious items become the lettered exhibits in the case report. Each mark is signed onto the case timeline.

Marking does not copy or preserve the underlying payload. To keep payloads from being deleted, place a legal hold.

Quick mitigation#

A case page can act on what it found, and records each action on the case as containment with who ran it and when:

Each needs a reason, and each is signed. Anything slower, such as rotating a credential, is proposed as a containment, remediation or mitigation action and moved through Accept, Done or Not doing. A remediation needs a line on how you know it is done. A true positive cannot close while a containment action is still open.

Reportability#

For a case that may need to be reported, record a decision per regime: Reportable, Not reportable or Does not apply, with the reason. Golem starts each clock from when you became aware and shows the deadline.

Declare your role for the EU AI Act under Cases → Settings. Golem uses it to pre-fill the row and choose which articles a report cites. It does not decide your obligations, and only a person can record a reportability decision.

Closing#

Close a case with a disposition (True positive, False positive, Expected activity or Couldn't tell) and a summary. A true positive also needs a root cause, and a dangerous or malicious one needs lessons learned. Closing resolves every flag in the case with the case's disposition unless a person already gave a flag its own.

Under Cases → Settings, Second approver can require someone else to approve a close: for true positives and dangerous or malicious cases, or for every case. A person who owns an agent or machine the case is about never approves its close.

Agents working a case#

Golem's MCP tools let an agent help with a case: escalate and link, comment, mark evidence, resolve flags, and quarantine a machine. An agent cannot escalate anything from its own machine. It can only propose a classification, an action or a close; a person accepts each one, and whoever accepts a close is recorded as the person who closed it. Corrected clock times, reportability, assignment, legal holds and exports are for people only.

Legal hold#

Workspace owners and admins can place a hold on the whole workspace, a case or a conversation, with a reason, under Cases → Settings → Legal holds or from a case's menu. A held case, its flags and its conversations are not deleted by retention until the hold is lifted, and rules cannot be deleted while any hold is active (move them to shadow instead). Holds are never deleted, and placing and lifting are signed.

Payload bodies live in your storage. Golem only ever expires them through its own retention rule on Google Cloud Storage, which skips held objects. Golem never expires payloads in other storage, so holding those is up to your own retention settings.

Reports#

A case's Report tab assembles the summary, what happened, the exhibits, scope, actions, reportability, classification, and a verification section counting how many case events carry a signed entry. Download PDF saves it. The PDF is for reading; the signed artifact is the evidence export.

For audits, Evidence → Reports builds workspace reports over a date range or a session: Compliance, Record-keeping, Evidence Pack, SOC 2, ISO 27001, Session Forensic and Activity Summary. The SOC 2, ISO 27001 and Evidence Pack reports map controls (for example SOC 2 CC7.1 to CC7.5 and ISO 27001 A.8.15, A.8.16 and A.5.25 to A.5.28) to the evidence for each. The record-keeping report cites the EU AI Act articles that match your declared role. Each control is marked as evidence provided or needing attention, never as satisfied: that judgment belongs to your auditor.

Evidence export#

On a case, Export evidence downloads a signed zip of everything the case rests on. Tick Include payload bodies to add the stored payloads the case cites. Exporting is for workspace owners and admins, and each export is itself signed into the evidence chain.

The package holds:

• the case, its full timeline and its comments;
• every session chain the case cites, in full, with the machines' public keys;
• the workspace evidence chain, and the entry recording this export;
• every flag in scope, with totals that must reconcile (raised equals resolved, plus in open cases, plus awaiting triage);
• the rules, legal holds and case settings in force;
• a Merkle proof for the evidence chain;
• a readable summary as HTML and PDF;
• verify.py and instructions for running it.

The manifest of every file's hash is signed by your workspace's evidence key. An auditor can check the whole package offline:

pip install cbor2 cryptography
python3 verify.py golem-evidence-....zip

It exits 0 only when every check passes. What it checks, and how to read its output, is in Checking it yourself.

An export holds at most 500 sessions, 200,000 entries, 2,000 payloads and 64 MB. Exporting a period rather than a case is available through the API only. Control maps for SOC 2 and ISO 27001 are in the reports above, not in the export package.

Send findings to your SIEM#

Under Defender → SIEM output, send flags, quarantines, rule changes and case events to Datadog (your site and an API key, which is sealed and shown afterward only as a fingerprint) or to a Webhook (ECS) endpoint over HTTPS, one Elastic Common Schema document per request. Set a Minimum severity to cut noise. Case events carry the case id, severity, status, disposition, actor and evidence hash, never the title, summary or comments. Splunk works through its HTTP Event Collector as a webhook endpoint; there is no syslog output.

Case opens, closes and reopens can also go to Slack, PagerDuty, Opsgenie or email: set this under Cases → Settings → Case updates go to, using routes made in Alerts → Settings. PagerDuty and Opsgenie page only for dangerous and malicious cases, and a close resolves the page.