life of a case

[JohanBogema]

Hi all,

I am trying to figure out the life of a case and run into a question I can't seem to find the documentation about:

What happens when a case has been set to resolved but a new matching issue pops up? Is a new case created or is the resolved case re-opened?

[susekar]

Hello @JohanBogema ,

Greetings for the day.

In Cortex XSIAM, the behavior when a new matching issue occurs for a resolved case depends on the specific resolution status and the timing of the new alert.

1. Automatic Reopening (Within 6-Hour Window):

If a case is resolved with the status Resolved - Auto Resolve, Cortex XSIAM will automatically reopen the case if a matching issue occurs within a six-hour grace period.

• Status Change: The case status reverts from Resolved back to New to ensure it is visible to analysts.
• Window Calculation: This six-hour window is based on the timestamp of the last issue that was grouped into the case, not the time the case was marked as resolved.

2. New Case Creation (After 6-Hour Window):

Once the six-hour grouping window has passed, any new matching issues will trigger the creation of a new case for a separate investigation.

3. Manual Resolution Behavior:

If a case is resolved manually (for example, using statuses such as Resolved - True Positive or Resolved - False Positive), the system behavior changes to preserve the integrity of the completed investigation.

• Grouping Disabled: Manual resolution typically sets the Alerts Grouping Status to Disabled.
• Effect: New matching alerts generally do not reopen the manually resolved case and may instead generate a new case or remain unassociated, depending on the applicable grouping logic.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar