> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md). # Analyze case details Once you have established the initial context, you can use the case **Overview** and **Timeline** to deconstruct the case and understand how its underlying components are connected, and review the full scope of activity. * **Overview** * **Grouping Graph:** View a visual mapping of how issues and artifacts are linked together, including details on shared artifacts, to better understand the underlying grouping logic. * **Evidence:** Trace issue causality chains and recorded events to follow the attack sequence from the initial root cause to the final recorded activity. * **Issue feed** Review the case’s story in a chronological visualization that maps the case lifecycle and highlights key case information, with the option to group by attribute. * **Associated assets and artifacts:** Drill down into the specific identities, endpoints, and digital artifacts associated with the case to assess the threat's footprint. * **MITRE ATT\&CK tactics and techniques:** Review the specific tactics and techniques identified in issues linked to the case to align your investigation with industry-standard adversary behaviors.

Note

If you prefer a tabular or legacy layout, switch the case card to the Detailed view.

This view preserves the legacy tab based format and custom layouts, ensuring full backward compatibility. You can switch between the new case experience and the legacy view based on personal workflow preferences. For more information, see Detailed view.

* **Timeline** View the full lifecycle of a case. You can also add your own records and mark key observations as evidence to be used in formal reporting. *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.