---
title: Creating a Case and Linking from Investigation Canvas
description: Use this section to create and link a case\(s\) from an investigation canvas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-link-case.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Working with Investigation Canvas, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Creating a Case and Linking from Investigation Canvas

Use this section to create and link a case\(s\) from an investigation canvas.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Select **Threat Analyst Workbench** icon.

3.  Go to **Case Management** > **All Cases**.

    This displays all the cases.

4.  Open any case record from the list.

5.  Select **Link Case** from the **Details** section.

    The Create and Link Case dialogue box appears.

6.  Select a case from the list to associate the case to an investigation canvas.

7.  Select **Create New Canvas**.

    The Create New Case dialogue box appears.

8.  Fill in the form fields, as appropriate.

<table id="table_fkk_wc1_zfc"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Case ID

</td><td>

A unique identifier for the case. This is system generated ID.

</td></tr><tr><td>

Short description

</td><td>

Summary of the request or issue that is being investigated or a short description.

</td></tr><tr><td>

Case Type

</td><td>

Select the type of case being investigated. The possible options for the investigation are:-   Threat Hunting
-   Request for Information
-   Vulnerability Management Case
-   Compliance Case
-   Incident Response Case
-   Collaboration Case
-   Others


</td></tr><tr><td>

Priority

</td><td>

Indicates the priority of a case.

</td></tr><tr><td>

Assignment group

</td><td>

The assigned group responsible for working on the case.

</td></tr><tr><td>

Status

</td><td>

The current status of the case.

</td></tr><tr><td>

Assigned to

</td><td>

The analyst who is responsible for working on a case.

</td></tr></tbody>
</table>9.  Select **Create and Link** to create a new case and link it directly to the investigation canvas.

    A confirmation is displayed confirming that the case is created and linked to the investigation canvas successfully.

    **Note:** This option is useful when no existing case is associated with the investigation canvas.

10. To remove a linked case, select the **Unlink** button.

    For more information on how to directly link an existing case to the investigation canvas, see [Linking an existing case from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-link-existing-case-canvas.md).


**Parent Topic:**[Working with Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-investigation-canvases.md)

**Related topics**  


[Creating an investigation canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-canvas.md)