A library consortium wants forensic automation outputs stored with case IDs that match SOAR. Why does that linkage matter?

A library consortium that wants forensic automation outputs stored with case IDs that match SOAR should link forensic tooling outputs to municipal case IDs that match SOAR so evidence stays tied to the IR case. Shared identifiers prevent orphaned dumps, duplicate investigations, and “which ticket does this disk image belong to?” failures during handoffs between consortium members. When forensics, SOAR, and ticketing speak the same case language, auditors and counsel can follow a continuous civic evidence path from alert to artifact. Why the other options fail by concept: Linking forensic tooling outputs to municipal case IDs that match SOAR so triage stays tied to the SOAR playbook uses the right linkage for the wrong outcome, because playbook workflow alignment does not keep evidence tied to the IR case. Linking forensic tooling outputs to municipal case IDs that match SOAR so alert stays tied to the SIEM detection rule uses the right linkage for the wrong outcome, because SIEM rule traceability does not keep evidence tied to the IR case. Linking forensic tooling outputs to municipal case IDs that match SOAR so artifact stays tied to the intel feed uses the right linkage for the wrong outcome, because intel feed enrichment does not keep evidence tied to the IR case. Exam caveat: case ID linkage must respect access control—shared IDs do not mean every consortium staffer should read every memory image. Operational check: configure forensic automation to write outputs into paths or object keys that include the SOAR case ID, verify a sample library incident shows matching IDs in SOAR and the forensics store, and reject intake jobs that lack a valid case reference.