-
-
Notifications
You must be signed in to change notification settings - Fork 0
Case Lifecycle
How a case moves from open to closed, what closing actually changes, and the reviewer requirement that now gates it.
Nine states are seeded on first boot. Three are protected and cannot be deleted — Unspecified, Open and Closed; the rest are ordinary rows you can add to or rename in the database.
| State | Meaning |
|---|---|
| Unspecified | No state set |
| Open | Case is open |
| In progress | Case is being investigated |
| Containment | Containment is in progress |
| Eradication | Eradication is in progress |
| Recovery | Recovery is in progress |
| Post-Incident | Post-incident phase |
| Reporting | Reporting is in progress |
| Closed | Case is closed |
State IDs are assigned per deployment — resolve them by name, never hardcode a number.
Available from
IRIS-NG-v1.4.0.
A case cannot be closed until a reviewer is assigned in the Reviewer field on the case's Info tab.
There are two ways to close a case, and both are blocked:
| How | What happens without a reviewer |
|---|---|
| The Close case button in the case modal | Refuses, and names the field to set |
| Setting State → Closed and pressing Save | Refuses the save, same message |
Both routes really do close the case, so guarding only the button would have left the State dropdown as a one-click bypass.
Two details that are deliberate:
- Assigning a reviewer and closing in the same save works. The State route reads the reviewer you just picked in the form, not the stored one.
- The Close button reads the stored reviewer, so picking one from the dropdown without saving does not unlock it. That button closes the case without submitting the form, so an unsaved selection would not have reached the server.
- Editing an already-closed case is still allowed even if it has no reviewer. The check only fires when a case is actually transitioning into Closed, so cases closed before this shipped are not frozen.
The API is not guarded.
POST /manage/cases/close/<id>andPUT /api/v2/cases/<id>with a Closed state will still close a case with no reviewer. A script, an n8n workflow orcurlbypasses the requirement entirely.
That is a deliberate choice, so that existing automation which closes cases keeps working. Treat the rule as a guard against analyst error, not as an invariant you can rely on when reading the database — a case closed by automation may have no reviewer.
Cases closed before this shipped are untouched and keep whatever reviewer they had, if any.
| State | Set to Closed |
| Close date | Set to now (UTC) |
| Related alerts | Moved to Closed, and their resolution status is set from the case's outcome |
| Time tracking | Locked — entries can no longer be created, edited or deleted while the case is closed. See Analyst Time Tracking |
| Dashboard | The case drops out of Attributed open tasks, and its tasks stop counting toward that tile even if they were never individually marked done |
Closing does not delete or hide anything. The case, its evidence and its timeline stay fully readable, and export still produces a complete file.
Reopening clears the close date and moves the related alerts back to Merged.
Reopening always sets the state to Open, not the state the case was in before it was closed. A case closed from Containment comes back as Open, and the previous state is not recorded anywhere. Set it again by hand if it mattered.
Time-tracking edits unlock again on reopen.
These are two separate fields and only the first one gates closing:
- Reviewer — a user assigned to review the case. This is what the close requirement checks.
- Review status — No review required, Not reviewed, Pending review, Review in progress, Reviewed. Tracked independently, and not checked when closing: a case can be closed with a reviewer assigned and the review still unstarted.
Removing a case's reviewer resets its review status to Not reviewed automatically.
- Analyst Time Tracking — what the close lock means in practice
- Analyst Skills and Teams — assigning analysts to a case
- Object History — cases do record created, case closed and case reopen in their history column, but unlike events, IOCs and assets they have no panel to read it from yet