How to resolve a case

Follow the steps to resolve a case and record its outcome.

You can resolve a case in the following ways:

• Manually on the Cases page:

  • Click the case status and select Resolved.
  • In the Resolve case dialog, select the resolution reason and leave a comment.
  • Select whether to resolve all of the issues in the case, and whether to create an exclusion.
  • Click Resolve.
• In the API, run the Update Case command .

Note

If a case is resolved with the status Resolved - Auto Resolved, Cortex Cloud can reopen the case for up-to six hours if a new issue is triggered that matches the case. The six-hour period is defined by the timestamp of the last issue that was grouped into the case. After the six-hour period, any new issues are linked to a new case for a new investigation.