> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis.md).
# Start case analysis
{% hint style="info" %}
### Note
This section describes the product in **default mode** and using the **Split** view. If you are using **legacy mode**, see [Detailed View](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view.md).
{% endhint %}
To start analyzing a case, open the case from the main **Cases** page. In the Split view, click a case to open it in the side panel. To open a case in a full page layout, right-click a case in the list and select **View case in new tab**.
The case card opens a dedicated workspace where you can fully understand, investigate, and resolve the case from start to finish.
The case card brings together case context, correlated issues, affected assets, and remediation actions in one place. It helps you quickly understand the case context, see how events are connected, and take action with confidence. Click through the view to dive into investigation data, resolution tasks, and AI assistance without switching pages or losing context, keeping your focus on resolution.
**Case analysis and resolution process**
**Core components**
The following table describes the core components of case analysis and resolution:
| Component | Description | Link to detailed information |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agentic Assistant | Provides side-by-side support by recognizing case context, delivering advanced summarization, and helping you pivot to additional investigative views. | [Agentic Assistant — Case Investigation agent](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md) |
| AI-generated case title and description | Helps you quickly understand the scope and nature of the case by summarizing key case details. | [AI-generated case summaries](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context.md) |
| Case overview | Breaks down case components to help you understand how the case was built:
- Grouping graph: Illustrates issue relationships
- Evidence: Details casualties and events
- Issue feed: Narrates the case story
- Associated assets, artifacts, and MITRE ATT\&CK tactics: Provides additional context and links to detailed views and actions
| [Analyze case details](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details.md) |
| Case timeline | Provides a chronological record of security events and analyst actions to streamline investigations and evidence management. | [Case timeline](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline.md) |
| Detailed view | Provides detailed information about the investigation in a tabular format, for example Timeline and War Room. | [Detailed View](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view.md) |
| Resolution Center | Guides you towards resolution by presenting actionable remediation steps and enables you to track all related playbook tasks without opening individual playbooks. | [Resolution Center](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center.md) |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.