Resolve a case - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation
Product
Cortex XDR
License
XDR + Cloud
Creation date
2025-07-13
Last date published
2026-06-04
Category
Administrator Guide

You can resolve a case in the following ways:

  • Manually on the Cases page:

    • Click the case status and select Resolved.

    • In the Resolve case dialog, select the resolution reason and leave a comment.

    • Select whether to resolve all of the issues in the case, and whether to create an exclusion.

    • Click Resolve.

  • In the API, run the Update Case command .

Note

If a case is resolved with the status Resolved - Auto Resolved, Cortex XDR can reopen the case for up-to six hours if a new issue is triggered that matches the case. The six-hour period is defined by the timestamp of the last issue that was grouped into the case. After the six-hour period, any new issues are linked to a new case for a new investigation.