# Cases and evidence export > Triage a flag, gather evidence into a case, run the clock to containment, and export a signed package an auditor can check offline. A flag is something a rule, a reviewer or a person thought worth a look. Most flags are noise, and you resolve them with what they were. The ones that are real become a case: one owner, the evidence in one place, a clock from detection to containment, and a record of every decision that you can export and check without trusting Golem. Every triage decision, case event and export is signed into your workspace's evidence chain, the same way your agents' calls are signed into theirs. See [The signed record](/record). ## Triage a flag Flags wait under **Watch → Alerts**. Filter by severity (**Suspicious**, **Dangerous**, **Malicious**), by **Review required**, or group them by **Source** to see which rule or reader raised them. For each flag, do one of two things: - **Resolve** it with what it was: | Disposition | When to use it | |---|---| | False positive | The source got it wrong. Counts against that source's accuracy. | | Expected activity | It happened as described, but it was allowed. A candidate for an exception. | | Couldn't tell | Not enough to decide. Counts neither way. | A note is optional, up to 1,000 characters. - **Escalate** it into a case if it is real, by opening a new case or adding it to an existing one. Select several flags to resolve or escalate them together. A source's card offers **Resolve all from this source** when one rule is clearly misfiring, and shows how its flags were resolved so far. Only people's dispositions count toward a source's accuracy, not an agent's. A flag can be in one case at a time. A flag that is in a case closes when the case does, so it cannot be resolved separately from **Alerts**. ## Cases Open a case by escalating flags, or with **Add to case** from an event, a conversation, an inventory item or a machine. You can link flags, conversations, sessions, machines, inventory items and single events. | Field | What it holds | |---|---| | Title | Defaults from the first flag | | Severity | Suspicious, Dangerous or Malicious. Linking a worse flag raises it. | | Status | Open, Investigating or Closed | | Assignee | Exactly one person. Handing a case to someone else needs a handoff note. | The assignee, anyone marked **Working** on it, and workspace owners and admins can change a case. Anyone else can **Watch** it. Nothing in a case is ever deleted: its events and comments are append-only, and removing a flag sends it back to **Alerts** with that removal recorded. Several cases about the same incident can be gathered under one with **Condense into one case**. Closing that parent closes every open child with the same disposition, and reportability is decided once, on the parent. Set who gets new cases under **Cases → Settings**, as the **Default assignee**. Without one, an agent cannot open a case. ### The clock Every case shows how long each step took after detection: | Step | Recorded by | |---|---| | Detected | Golem: the earliest flag in the case | | Opened | Golem, when the case was opened | | Acknowledged | Golem, at the assignee's first action on the case. A person can correct it. | | Contained | Golem, when the last open containment action is done. A person can correct it. | | Closed | The close | A corrected time cannot be in the future or before detection, keeps the old value on the timeline, and can only be set by a person. ### Marking evidence On a case's **Evidence** tab, or turn by turn in its **Investigate** tab, mark each item **Bad**, **Suspicious**, **Context** or **Benign**, with an optional confidence and note. Marking an item adds it to the case if it was not there. Bad and suspicious items become the lettered exhibits in the case report. Each mark is signed onto the case timeline. Marking does not copy or preserve the underlying payload. To keep payloads from being deleted, place a legal hold. ### Quick mitigation A case page can act on what it found, and records each action on the case as containment with who ran it and when: | Action | What it does | |---|---| | Quarantine host… | New sessions on that machine come up restricted until someone clears it. See [Quarantine a machine](/response#quarantine-a-machine). | | Safe mode… | Clamps a machine or an agent to a safe set of tools. See [Safely](/response#safely). | | Enforce rule… | Moves a rule that is in shadow to enforcing | | Block asset… | Blocks an MCP server, tool or other inventory item | Each needs a reason, and each is signed. Anything slower, such as rotating a credential, is proposed as a containment, remediation or mitigation action and moved through **Accept**, **Done** or **Not doing**. A remediation needs a line on how you know it is done. A true positive cannot close while a containment action is still open. ### Reportability For a case that may need to be reported, record a decision per regime: **Reportable**, **Not reportable** or **Does not apply**, with the reason. Golem starts each clock from when you became aware and shows the deadline. | Regime | Default deadline | |---|---| | GDPR Art. 33 | 72 hours | | NIS2 Art. 23 | 24 hours | | SEC 8-K 1.05 | 4 business days | | EU AI Act | Depends on your declared role and whether your use is high-risk | Declare your role for the EU AI Act under **Cases → Settings**. Golem uses it to pre-fill the row and choose which articles a report cites. It does not decide your obligations, and only a person can record a reportability decision. ### Closing Close a case with a disposition (True positive, False positive, Expected activity or Couldn't tell) and a summary. A true positive also needs a root cause, and a dangerous or malicious one needs lessons learned. Closing resolves every flag in the case with the case's disposition unless a person already gave a flag its own. Under **Cases → Settings**, **Second approver** can require someone else to approve a close: for true positives and dangerous or malicious cases, or for every case. A person who owns an agent or machine the case is about never approves its close. ### Agents working a case Golem's MCP tools let an agent help with a case: escalate and link, comment, mark evidence, resolve flags, and quarantine a machine. An agent cannot escalate anything from its own machine. It can only propose a classification, an action or a close; a person accepts each one, and whoever accepts a close is recorded as the person who closed it. Corrected clock times, reportability, assignment, legal holds and exports are for people only. ## Legal hold Workspace owners and admins can place a hold on the whole workspace, a case or a conversation, with a reason, under **Cases → Settings → Legal holds** or from a case's menu. A held case, its flags and its conversations are not deleted by retention until the hold is lifted, and rules cannot be deleted while any hold is active (move them to shadow instead). Holds are never deleted, and placing and lifting are signed. Payload bodies live in your storage. Golem only ever expires them through its own retention rule on Google Cloud Storage, which skips held objects. Golem never expires payloads in other storage, so holding those is up to your own retention settings. ## Reports A case's **Report** tab assembles the summary, what happened, the exhibits, scope, actions, reportability, classification, and a verification section counting how many case events carry a signed entry. **Download PDF** saves it. The PDF is for reading; the signed artifact is the evidence export. For audits, **Evidence → Reports** builds workspace reports over a date range or a session: **Compliance**, **Record-keeping**, **Evidence Pack**, **SOC 2**, **ISO 27001**, **Session Forensic** and **Activity Summary**. The SOC 2, ISO 27001 and Evidence Pack reports map controls (for example SOC 2 CC7.1 to CC7.5 and ISO 27001 A.8.15, A.8.16 and A.5.25 to A.5.28) to the evidence for each. The record-keeping report cites the EU AI Act articles that match your declared role. Each control is marked as evidence provided or needing attention, never as satisfied: that judgment belongs to your auditor. ## Evidence export On a case, **Export evidence** downloads a signed zip of everything the case rests on. Tick **Include payload bodies** to add the stored payloads the case cites. Exporting is for workspace owners and admins, and each export is itself signed into the evidence chain. The package holds: - the case, its full timeline and its comments; - every session chain the case cites, in full, with the machines' public keys; - the workspace evidence chain, and the entry recording this export; - every flag in scope, with totals that must reconcile (raised equals resolved, plus in open cases, plus awaiting triage); - the rules, legal holds and case settings in force; - a Merkle proof for the evidence chain; - a readable summary as HTML and PDF; - `verify.py` and instructions for running it. The manifest of every file's hash is signed by your workspace's evidence key. An auditor can check the whole package offline: ```bash pip install cbor2 cryptography python3 verify.py golem-evidence-....zip ``` It exits 0 only when every check passes. What it checks, and how to read its output, is in [Checking it yourself](/record#checking-it-yourself). An export holds at most 500 sessions, 200,000 entries, 2,000 payloads and 64 MB. Exporting a period rather than a case is available through the API only. Control maps for SOC 2 and ISO 27001 are in the reports above, not in the export package. ## Send findings to your SIEM Under **Defender → SIEM output**, send flags, quarantines, rule changes and case events to **Datadog** (your site and an API key, which is sealed and shown afterward only as a fingerprint) or to a **Webhook (ECS)** endpoint over HTTPS, one Elastic Common Schema document per request. Set a **Minimum severity** to cut noise. Case events carry the case id, severity, status, disposition, actor and evidence hash, never the title, summary or comments. Splunk works through its HTTP Event Collector as a webhook endpoint; there is no syslog output. Case opens, closes and reopens can also go to Slack, PagerDuty, Opsgenie or email: set this under **Cases → Settings → Case updates go to**, using routes made in **Alerts → Settings**. PagerDuty and Opsgenie page only for dangerous and malicious cases, and a close resolves the page.