Use incidents to track the work to investigate potential threats.
Potential threats leading to case creation come from seeing a suspicious event, an alarm that has triggered, an alert from a correlation rule, suspicious information from a report, or something similar.
An analyst might have a queue of cases, possibly created by other analysts, on which to perform further investigation.
You can add contextual details and events to the incident notes and track the investigative work. When resolved, close the incident and build alarms that apply the information uncovered in this incident.