Cases are classified as Open or Closed and are listed on the Cases page.
Cases with the following statuses are considered open:
Declared
Scoped
Contained
Cases with the following statuses are considered closed:
Recovered
Improved
A case can be in Recovered or Improved status and still have open alerts assigned to it, if the alerts belong to other cases.
For more information about case statuses, see Characteristics of a case.
A change in status will move a case from open to closed or closed to open. For example, changing a case's status from Improved to Scoped will "re-open" a case by moving it from the Closed to the Open list.
On the Cases page, click
at the end of the row. Select Edit.Choose a new status from the drop-down menu.
Click Edit Case.
Important
When a case is closed, all alerts that belong to that case only are also closed. Alerts that belong to one or more other cases are not closed. A message will warn you if alerts belong to multiple cases.
Note
For more information about case statuses and other details, see Understanding case details.