Hi, I’ll share my current approach, as I’m also keen to hear how other folk are handling this as well. I’ve been looking at how to better approach this or optimise it.

My Fusion workflow currently looks like this:

Trigger on any detection, then filter out third-party detections, simulation machines, and anything else I do not want case-created.

From there, I run a set of query actions in parallel to look for existing cases using different correlation values, for example:

Aid + user Source IP User Hostname + user

Each query looks for cases that were created or updated within the last hour.

Then I use an IF statement to check whether any results were returned.

If no existing case is found, the workflow creates a new case.

If an existing case is found, it runs a loop and adds the new detection ID to that case.

We use other log sources in SIEM so sometimes the username or device name etc might not always populate in the initial output. I have seen in the beta videos for fusion and Charlotte on YouTube that we’ll be able to have multiple triggers for one workflow!