---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Affected users in cases

# Affected users in cases {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can create a new case from one or more affected users in the User \[sys_user\] table.
You can also add users to existing cases.
* **[Create a case from affected users](https://servicenow-prod.fluidtopics.net/r7lS0LwsliPGsUyVv9JSrA)**   
  You can create a security case from affected users in the User \[sys_user\] table. After the affected users have been used to create a new case, you can use Security Case Management to analyze the data.
* **[Add affected users to existing cases](https://servicenow-prod.fluidtopics.net/LOv_muUVh33jr9_GJ_B8aw)**   
  You can add affected users to one or more existing cases. After the user records have been added to cases, you can use Security Case Management to analyze the data.

**Related concepts**   

* [IoCs and observables in cases](https://servicenow-prod.fluidtopics.net/qyAKXsQrLeCMszdo9WHwsw "In Threat Intelligence, you can create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You can also create observables directly from a case.")
* [Security incidents in cases](https://servicenow-prod.fluidtopics.net/XBtNos2KOnm8izozfspq6A "In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.")
* [Configuration items in cases](https://servicenow-prod.fluidtopics.net/UbIFNlTe7tYZHzdZ701NIA "You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.")