Note

Cases are in beta. Features may change, and some functionality may be limited.

Coralogix Cases is an operational issue management experience that helps teams understand, triage, and respond to real problems detected by alerts.

While alerts represent symptoms, Cases represent the operational problem and provide the context and workflow needed to investigate and resolve it. To learn how Cases differ from Incidents, see [Cases vs. Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents/index.md).

### Case lifecycle

```
flowchart LR
    Alert["Alert fires"]
    Pending["Pending Activation"]
    Active["Active"]
    Ack["Acknowledged"]
    Resolved["Resolved"]
    Closed["Closed"]

    Alert --> Pending
    Pending --> Active
    Pending -.->|auto-resolves| Resolved
    Active --> Ack
    Active --> Resolved
    Ack --> Resolved
    Resolved --> Closed
```

Each stage can trigger notifications through [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction/index.md) routing rules configured for Case lifecycle events.

## Quick start

1.

**Define which alerts create Cases.** Select **Settings**, then **Cases** and configure Case filtering rules to control which alerts generate Cases automatically. See [Set up Cases](https://coralogix.com/docs/user-guides/cases/quick-start/index.md).

2.

**Route notifications.** Add routing labels to alert definitions and configure routing rules in the [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction/index.md) so the right teams get notified.

3.

**Triage and investigate.** Open **Alerts**, then **Cases** to view all active and historical Cases. Filter, prioritize, and drill down into affected services and telemetry. See [Working with Cases](https://coralogix.com/docs/user-guides/cases/working-with-cases/index.md).

4.

**Integrate with external tools.** Synchronize Cases with ServiceNow for lifecycle management across environments. See [ServiceNow integration](https://coralogix.com/docs/user-guides/cases/sn-integration/index.md).

## Why use Cases

Modern systems generate large volumes of alert activity. Without operational context, teams spend time interpreting signals instead of resolving issues. Cases provide:

- **Operational focus** --- respond to real problems, not individual alert events
- **Ownership tracking** --- engage the correct responders through notification workflows
- **Curated triage** --- understand impact with a 360-degree view of system behavior and telemetry
- **External integration** --- align workflows with systems like ServiceNow
- **Noise reduction** --- filter out short-lived or unstable alert activity

## What you can do

- **[Set up Cases](https://coralogix.com/docs/user-guides/cases/quick-start/index.md)** --- Configure filtering rules, timing, noise reduction, and notification routing
- **[Work with Cases](https://coralogix.com/docs/user-guides/cases/working-with-cases/index.md)** --- View, filter, prioritize, and investigate triggered Cases
- **[Cases analytics](https://coralogix.com/docs/user-guides/cases/analytics/index.md)** --- Track Mean Time to Acknowledge, Mean Time to Resolve, and Mean Time Between Incidents across teams, services, and priorities, and save analytics views for recurring reviews
- **[Configure settings](https://coralogix.com/docs/user-guides/cases/cases-setting/index.md)** --- Manage Case configuration and preferences
- **[ServiceNow integration](https://coralogix.com/docs/user-guides/cases/sn-integration/index.md)** --- Synchronize Cases with ServiceNow for lifecycle management
- **[Cases vs. Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents/index.md)** --- Understand how Cases differ from Incidents

## Who should use Cases

- **SRE and platform teams** managing service reliability
- **Security teams** investigating operational impact
- **DevOps teams** responding to production issues
- **IT and support teams** integrating with ITSM workflows
- **Engineering teams** tracking operational response and reliability metrics

## Data retention

Coralogix retains Cases for 1 year from their creation date, then automatically removes them along with their activity history. If your Coralogix account ends sooner, Coralogix removes all Cases when the account closes.

If your organization requires a shorter retention period --- for example, to meet compliance or privacy requirements --- contact your Coralogix account team or [support@coralogix.com](mailto:support@coralogix.com) to configure a shorter duration for your account.

## Related resources

[Alerting](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/) [Incidents](https://coralogix.com/docs/user-guides/alerting/incidents/) [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction/) [Infrastructure Explorer](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/overview/)

## Support

Reach our customer success team 24/7 via the in-app chat or by email at [support@coralogix.com](mailto:support@coralogix.com).

## Next steps

Learn how Cases differ from the legacy Incidents experience in [Cases vs Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents/index.md).