--- title: Cases description: Coralogix Cases unifies related alerts into contextual, intelligent incidents, reducing noise, accelerating triage, and improving collaboration across teams. url: https://coralogix.com/docs/user-guides/cases/overview/ product: cases feature: Cases Overview feature_id: cases-general feature_identifier: cases/cases-general last_updated: '2026-11-10' --- # Cases Coralogix Cases is an operational issue management experience that helps teams understand, triage, and respond to real problems detected by alerts. While alerts represent symptoms, Cases represent the operational problem and provide the context and workflow needed to investigate and resolve it. To learn how Cases differ from Incidents, see [Cases vs. Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents.md). [UI preview](/docs/assets/ui-previews/cases/cases-overview.html) ### Case lifecycle Each stage can trigger notifications through [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md) routing rules configured for Case lifecycle events. ## Quick start 1 . **Define which alerts create Cases.** Select **Settings**, then **Cases** and configure Case filtering rules to control which alerts generate Cases automatically. See [Set up Cases](https://coralogix.com/docs/user-guides/cases/quick-start.md). 2 . **Route notifications.** Add routing labels to alert definitions and configure routing rules in the [Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md) so the right teams get notified. 3 . **Triage and investigate.** Open **Alerts**, then **Cases** to view all active and historical Cases. Filter, prioritize, and drill down into affected services and telemetry. See [Working with Cases](https://coralogix.com/docs/user-guides/cases/working-with-cases.md). 4 . **Integrate with external tools.** Synchronize Cases with ServiceNow for lifecycle management across environments. See [ServiceNow integration](https://coralogix.com/docs/user-guides/cases/sn-integration.md). ## Why use Cases Modern systems generate large volumes of alert activity. Without operational context, teams spend time interpreting signals instead of resolving issues. Cases provide: * **Operational focus**: respond to real problems, not individual alert events * **Ownership tracking**: engage the correct responders through notification workflows * **Curated triage**: understand impact with a 360-degree view of system behavior and telemetry * **External integration**: align workflows with systems like ServiceNow * **Noise reduction**: filter out short-lived or unstable alert activity ## What you can do * **[Set up Cases](https://coralogix.com/docs/user-guides/cases/quick-start.md)**: Configure filtering rules, timing, noise reduction, and notification routing * **[Case sources](https://coralogix.com/docs/user-guides/cases/case-sources.md)**: See every source that can open a Case, from Coralogix Alerts to Prometheus Alert Manager * **[Work with Cases](https://coralogix.com/docs/user-guides/cases/working-with-cases.md)**: View, filter, prioritize, and investigate triggered Cases * **[Cases analytics](https://coralogix.com/docs/user-guides/cases/analytics.md)**: Track Mean Time to Acknowledge, Mean Time to Resolve, and Mean Time Between Incidents across teams, services, and priorities, and save analytics views for recurring reviews * **[Automatic case analysis](https://coralogix.com/docs/user-guides/olly/automatic-case-analysis.md)**: Let Olly investigate matching Cases automatically and post a root-cause finding on each one * **[Configure settings](https://coralogix.com/docs/user-guides/cases/cases-setting.md)**: Manage Case configuration and preferences * **[ServiceNow integration](https://coralogix.com/docs/user-guides/cases/sn-integration.md)**: Synchronize Cases with ServiceNow for lifecycle management * **[Cases vs. Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents.md)**: Understand how Cases differ from Incidents ## Who should use Cases * **SRE and platform teams** managing service reliability * **Security teams** investigating operational impact * **DevOps teams** responding to production issues * **IT and support teams** integrating with ITSM workflows * **Engineering teams** tracking operational response and reliability metrics ## Data retention Coralogix retains Cases for 1 year from their creation date, then automatically removes them along with their activity history. If your Coralogix account ends sooner, Coralogix removes all Cases when the account closes. If your organization requires a shorter retention period (for example, to meet compliance or privacy requirements), contact your Coralogix account team or to configure a shorter duration for your account. ## Related resources [Alerting](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts.md)[Incidents](https://coralogix.com/docs/user-guides/alerting/incidents.md)[Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md)[Infrastructure Explorer](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/overview.md) ## Next steps Learn how Cases differ from the legacy Incidents experience in [Cases vs Incidents](https://coralogix.com/docs/user-guides/cases/cases-incidents.md). ## Permissions A case has no access policy of its own. Two separate checks decide what a user can do with it. **Reaching the case.** Most cases are opened by an alert, and a case carries the read permission of the alert type that opened it. Holding `CASES:READ` alone is not enough: you also need read permission for that alert type, and for every alert on the case when there is more than one. A case you cannot read is left out of the cases list rather than shown as denied. A case from a source that is not an alert needs only `CASES:READ`. See [What you need](https://coralogix.com/docs/user-guides/cases/working-with-cases.md#what-you-need) for the permission per alert type. **Acting on the case.** Alert permission does not carry any of this. Updating, assigning, acknowledging, closing, or commenting each needs its own `CASES:*` permission, listed below. To restrict who can reach a case, set the [access policy](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md#manage-alert-access) on the alert definition that creates it. Policies in Cases apply to [saved views](https://coralogix.com/docs/user-guides/cases/saved-views.md#access-policy), not to individual cases. The permissions below govern which actions a user can take on a case they can already reach. Cases permissions | Resource | Description | System roles | API presets | | -------------------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ----------- | | `CASE-CONFIG:READ` | View Suppression window and Snooze period settings. | Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User | - | | `CASE-CONFIG:UPDATE` | Modify Suppression window and Snooze period settings. | Data Admin, Observability Lead, Platform Admin | - | | `CASES:ACKNOWLEDGE` | Allow user to acknowledge a case. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | - | | `CASES:ASSIGN` | Allow user to assign a case to themself or to someone else. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | - | | `CASES:CLOSE` | Allow user to close a case. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | - | | `CASES:COMMENT` | Allow user to comment on a case. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | - | | `CASES:CREATE` | Allow creating cases. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | Cases | | `CASES:READ` | Allow user to see the list of cases and individual cases. | Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User | - | | `CASES:UPDATE` | Allow user to update case. | Data Admin, Observability Lead, Platform Admin, Security User, Standard User | - | | `CASES-SAVED-VIEWS:MANAGE` | Manage saved views in Cases. | Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User | SavedViews | | `CASES-SAVED-VIEWS:READ` | View saved views in Cases. | Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User | SavedViews | | `CASES-SAVED-VIEWS:READACCESSPOLICY` | View access policies for Cases saved views. | Data Admin, Observability Lead, Platform Admin, Security User | SavedViews | | `CASES-SAVED-VIEWS:UPDATEACCESSPOLICY` | Manage access policies for Cases saved views. | Data Admin, Observability Lead, Platform Admin, Security User | SavedViews | | `CASES-TEAM-DEFAULT-VIEWS:MANAGE` | Define the team-level default view in Cases settings. | Platform Admin | SavedViews | | `CASES-TEAM-DEFAULT-VIEWS:READ` | View the team-level default view in Cases settings. | Platform Admin | SavedViews |