Case

A record that groups the alerts, evidence, actions, and notes related to a single investigation in a SOC. It is the unit of work analysts open, work, and close, keeping an investigation organized and auditable.