In Cortex XSIAM, if you find related cases that belong together, you can merge them into a single case to streamline your workflow and consolidate your team's efforts.
### Key definitions
Before merging your cases, it is important to understand the two roles involved in this process:
* **Target case:** The primary case that remains active after the merge. It retains its ID, preserves its original data, and receives the combined information from the other case.
* **Source case:** The secondary case that is combined into the target case. After the merging process is complete, the source case is permanently deleted from the system.
### How to merge cases
1. Go to the **Cases** page.
2. Click the **Display** menu and switch to the **Table** view.
3. Select the checkboxes next to the cases you want to merge.
4. Right-click anywhere on the selected cases and select **Merge** cases from the context menu.
### Case merging rules: assignees, teams, scores, and data
When you merge a source case into a target case, the system determines ownership, team roles, scoring, and data retention using the following strict rules:
#### Case assignees
The target case's assignee always takes priority:
* **Target case has an assignee:** The target case keeps its assignee. The source case's assignee is automatically added to the target case as a Contributor.
* **Target case is unassigned:** The target case adopts the source case's assignee.
* **Multiple source cases with assignees and target case with no assignee:** If you are merging multiple source cases that have assignees into an unassigned target case, one of the source case assignees will be selected for the target case assignee. The remaining assignees are added to the target case as Contributors.
* **Both are unassigned:** The target case remains unassigned.
#### Case teams (contributors and watchers)
Unlike assignees, team members are never overwritten or deleted. Instead, they are combined:
* **Merged teams:** The contributors and watchers from both the source case and the target case are pooled together into the final target case, ensuring no one loses visibility.
#### Case scoring
Case scores are updated automatically or manually depending on your settings:
* **Rule-based score:** The system automatically recalculates the overall case score to include the scores and metrics from both the source and target cases.
* **Manual score:** You can manually enter a score, which will override any automated rule-based calculations.
#### Context data
Data retention is determined strictly by the target case destination:
* **Target data is kept:** If the target case has existing context data, it is preserved.
* **Source case data is deleted:** All context data from the source case is permanently lost upon merging, even if the target case has empty data fields.
⚠️ Always ensure important context data from the source case is manually copied over to the target case before initiating a merge, as the source case is deleted after the merge and its original data cannot be recovered.
<br>