---
title: Linking an existing case from Investigation Canvas
description: Use this section to link an existing case from the investigation canvas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-link-existing-case-canvas.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Working with Investigation Canvas, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Linking an existing case from Investigation Canvas

Use this section to link an existing case from the investigation canvas.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Select **Threat Analyst Workbench** icon.

3.  Go to **Case Management** > **All Cases**.

    This displays all the cases.

4.  Select **Case Management** > **All Cases**

5.  Open any case record from the list view.

6.  Select **Link Case** from the **Details** section.

    The Link a Case dialogue box appears.

7.  Select a case ID from the list to associate the case to an investigation canvas.

    \[Omitted image "tisc-link-an-existing-case-from-canvas.png"\] Alt text: Link an existing case from investigation canvas.

    A confirmation message is displayed confirming that the case is linked successfully.

    **Note:** In case if no case is available for linking to the Investigation Canvas, you can create a new case to initiate and organize your investigation context. For more information on how to create a new case, see [Creating a Case and Linking from Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-link-case.md)

    .

8.  To remove a linked case, select the **Unlink** button.


**Parent Topic:**[Working with Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-investigation-canvases.md)

**Related topics**  


[Creating an investigation canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-canvas.md)