> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Detection & Response

> Case Management — the SOC surface where you triage alerts, service tickets, and threat intelligence, then hand them to the AI.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

**Detection & Response** is the SOC surface of Myrmex — a single place to triage what your security tools are reporting and turn it into an AI-led investigation. You open it from **Case Management**, one of the quick actions in the Directory on the left, and it opens as a tab in the Workspace on the right.

## Three Tabs, One Surface

Case Management brings three streams of work together:

<CardGroup cols={3}>
  <Card title="Service Management (ITSM)" icon="ticket">
    The tickets and cases from your service-management tools, ready to read and
    hand to the AI.
  </Card>

  <Card title="Alerts" icon="bell" href="/documentation/detection-response/alerts">
    Unified triage of detections from every connected SIEM, EDR, and threat
    source.
  </Card>

  <Card title="Threat Intelligence" icon="fingerprint" href="/documentation/detection-response/threat-intelligence">
    Look up indicators of compromise and manage the feeds that bring your own
    indicators in.
  </Card>
</CardGroup>

## Scoped to Your Context

Like the rest of the console, Case Management is **scoped to the context you have selected** — the working environment chosen when you sign in. The alerts, tickets, and intelligence you see all belong to that context, and the same scope travels with anything you send to the AI. Switch context to move between environments. See [Core Concepts](/documentation/get-started/concepts#how-your-account-is-organized).

## From a Case to the AI

Detection & Response is where triage meets Myrmex's AI team. Whenever you send an item to chat or launch an investigation, it reaches **Centurion's SOC variant** — a version of the orchestrator tuned for detection and response, which pulls in specialists like Orion for enrichment and Perseus to act on a host.

<Card title="Centurion, in SOC mode" icon="shield-halved" href="/documentation/multi-agent-system/agent-orchestrator">
  Learn how the orchestrator coordinates a security investigation across the
  agent team.
</Card>

## Service Management (ITSM)

The **Service Management** tab lists the tickets and cases collected from your connected ITSM tools, scoped to your context. Open a ticket to review its details, then use **Send to Chat** to drop it into the conversation — where you can ask the AI to summarize it, correlate it with recent alerts, or draft a response.

<Note>
  Case Management is a triage and hand-off surface. You read, group, and route
  items from here; the investigation and any resulting actions happen in chat,
  where you review and approve them.
</Note>

## Go Deeper

<CardGroup cols={2}>
  <Card title="Alerts" icon="bell" href="/documentation/detection-response/alerts">
    Filter, group, and enrich detections, then investigate in bulk.
  </Card>

  <Card title="Investigation Wizard" icon="wand-magic-sparkles" href="/documentation/detection-response/investigation">
    Turn an alert into a structured SOC investigation in a few clicks.
  </Card>

  <Card title="Threat Intelligence & Feeders" icon="fingerprint" href="/documentation/detection-response/threat-intelligence">
    IOC lookups and bring-your-own indicator feeds (CSV, Text, MISP).
  </Card>

  <Card title="Audit Logs" icon="clipboard-list" href="/documentation/detection-response/logs">
    Myrmex's own trail of who did what, and when — for accountability and compliance.
  </Card>
</CardGroup>