> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/older-releases/09_casehub.md).

# 09\_CaseHub

## Overview

With BluSapphire Case-Hub, SOC operations can be automated through a streamlined workflow that minimizes manual work and prioritizes critical security incidents. This ensures that complex security responsibilities are handled and responded to efficiently.

### Features

**Events Rules:** Allows to automate certain operations, such as responding to events dynamically by dismissing them, merging them to cases, adding tags, or updating their severity automatically.

**Cases:** You can create Cases (or) merge multiple alerts into an existing case and utilize Case Templates to keep track of the investigation of alerts by your analyst.

**Intel Lists:** Allows you to create your own internal threat intelligence lists or poll from external sources, both of which will improve events and aid analysts in their investigations.

**Inputs Module:** To enable your SOC to analyze events and alerts from datalake (OpenSearch), you can create inputs. Inputs contain the required configuration to pull data from the backend.

**Reflex Query Language (RQL)**: In Case-Hub, Event-Rules utilize RQL for querying event data. Analysts can automate event actions for the matched events by creating event query rules that involve mutators and expressions.