Cortex XSIAM handles cases through a structured process that moves from identification to resolution.
<table><thead><tr><th width="200.25">Stage</th><th>Description</th></tr></thead><tbody><tr><td>Detection</td><td>Signals or findings surface across the environment.</td></tr><tr><td>Issue generation</td><td>Raw data is converted into structured, defined as Issues.</td></tr><tr><td>Case grouping</td><td>Issues are evaluated for case qualification. If the issue qualifies it is grouped into a case with related issues, or if no match is found, a new case is generated.</td></tr><tr><td>Case analysis</td><td>Examination of context, relationships, and evidence.</td></tr><tr><td>Response</td><td>Application of remediation actions to mitigate the threat.</td></tr><tr><td>Resolution</td><td>Final confirmation that the issues in the case are fully addressed.</td></tr></tbody></table>
