@d_patel_dj did your playbook attach to the alert? If so make sure you click the alert to open the view.

There are a few places where views can be configured. The first is the default view for the case and alert. This view configuration is under Settings -> Case Data -> Views.

• The Default Case View under Settings -> Views is what determines what the Case Overview screen will look like.


• The Default Alert View under Settings -> Views is what the system uses to build the alert view when a playbook is not attached to a alert or a playbook doesn't have a custom view created for it.

The second place you can configure a view is within the playbook. This view will show up in the alert screen whenever the playbook is attached to an alert. 

In saying this I believe what you are seeing is the Default Case View.

Is this a SCCE instance, or a 'traditional' SecOps?  What is the users's primary role?

I assume you've checked the user is inheriting roles correctly (a good test would be to assign the case to the user's primary Role and check if they can access the case?)