> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md).

# Merge a case

If you find related cases that belong together, you can merge them into a single case to streamline your workflow and consolidate your team's efforts.

### Key definitions

Before merging your cases, it is important to understand the two roles involved in this process:

* **Target case:** The primary case that remains active after the merge. It retains its ID, preserves its original data, and receives the combined information from the other case.
* **Source case:** The secondary case that is combined into the target case. After the merging process is complete, the source case is permanently deleted from the system.

### How to merge cases

1. Go to the **Cases** page.
2. Click the **Display** menu and switch to the **Table** view.
3. Select the checkboxes next to the cases you want to merge.
4. Right-click anywhere on the selected cases and select **Merge** cases from the context menu.

### Case merging rules: assignees, teams, scores, and data

When you merge a source case into a target case, the system determines ownership, team roles, scoring, and data retention using the following strict rules:

#### Case assignees

The target case's assignee always takes priority:

* **Target case has an assignee:** The target case keeps its assignee. The source case's assignee is automatically added to the target case as a Contributor.
* **Target case is unassigned:** The target case adopts the source case's assignee.
* **Multiple source cases with assignees and target case with no assignee:** If you are merging multiple source cases that have assignees into an unassigned target case, one of the source case assignees will be selected for the target case assignee. The remaining assignees are added to the target case as Contributors.
* **Both are unassigned:** The target case remains unassigned.

#### Case teams (contributors and watchers)

Unlike assignees, team members are never overwritten or deleted. Instead, they are combined:

* **Merged teams:** The contributors and watchers from both the source case and the target case are pooled together into the final target case, ensuring no one loses visibility.

#### Case scoring

Case scores are updated automatically or manually depending on your settings:

* **Rule-based score:** The system automatically recalculates the overall case score to include the scores and metrics from both the source and target cases.
* **Manual score:** You can manually enter a score, which will override any automated rule-based calculations.

#### Context data

Data retention is determined strictly by the target case destination:

* **Target data is kept:** If the target case has existing context data, it is preserved.
* **Source case data is deleted:** All context data from the source case is permanently lost upon merging, even if the target case has empty data fields.

{% hint style="warning" %}
⚠️ Warning: Always ensure important context data from the source case is manually copied over to the target case before initiating a merge, as the source case is deleted after the merge and its original data cannot be recovered.
{% endhint %}

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.