Define a case in Google SecOps SOAR?

A case is the central unit of investigation in Chronicle SOAR — a grouping of one or more related alerts, along with the entities (users, hosts, IPs) involved, that an analyst investigates and resolves as a single unit rather than triaging each underlying alert independently.

Under the unified Chronicle SecOps platform, every alert — whether generated by a SIEM-side YARA-L detection rule or ingested from a third-party tool via a SOAR connector or webhook — is automatically grouped into a case, consolidating related activity and giving analysts one place to review context, evidence, and enrichment rather than needing to manually correlate scattered individual alerts themselves.

From a case, an analyst can review its associated entities in detail, attach notes and evidence, trigger or review playbook execution, and ultimately close the case with a resolution status, and cases support bulk actions like merging — useful when multiple alerts that were initially grouped into separate cases turn out to be part of the same underlying incident.