> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/review-all-cases.md). # Review all cases The main **Cases** page is the starting point for monitoring and managing all cases in your environment. It provides visibility into all cases and their current status, helping you track progress, investigate individual cases, and take remediation actions. Severity indicators, scores, and starred icons help you quickly identify your high-priority cases. You can access the **Cases** page from **Cases & Issues → Cases**. By default, all open cases are displayed. ### **Viewing modes** You can control how data is displayed and how the page behaves by choosing both a display mode and a viewing format. * **Display modes (layout)**: You can choose how to visualize and interact with data on the page. Click the **Display** menu to switch between modes. Any changes that you make to the case fields persist between modes. * **Split view (default)** Displays cases in a split-pane layout that highlights key details and enables you to quickly compare cases, prioritize urgent items, and assess severity and impact at a glance. * **Table view** Displays cases in a table layout with widgets that summarize the table data. Widgets are customizable, allowing you to tailor the table for structured analysis and review. * **Viewing formats (behavior)**: You can choose how the page functions. To change format from the **Actions** menu select **Switch to xx view**. * **Default mode** Use the latest experience with full support for new features and functionality. * **Legacy mode** Use the previous experience for backward compatibility. This mode does not support all newly released functionality. The documentation in this guide describes the product in **default mode**. If you are using **legacy mode**, see [Detailed View](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/detailed-view.md).

Note

Administrators can enable or disable legacy mode. Go to Configurations → General → Server Settings → Case display modes.

### **Saved table views** Saved table views are saved filter configurations of table data that help you to focus on the data that most matters to you. You can filter your table data by domain, context, work queue, or other criteria, and save configurations that support your workflow. The default view on the Cases page is **All Cases**. Click on the arrow next to **All Cases** to see all available saved views. If you change the table filters, you will see a **Modified** label next to the view name. You can create a new saved views. Once you have change the table filters, click the three dots next to the view name to save the new configuration, update an existing saved view, or revert to the original configuration. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/review-all-cases.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.