- Get Started with Threat Center
- Group Detections
- Work on Cases
- Triage Alerts in Threat Center
- Edit and Collaborate in Threat Center
- Find Cases or Alerts
- Build a Search in Threat Center
- Enter a Search Using Exabeam Query Language in Threat Center
- Enter a Search Using Natural Language in Threat Center
- Run a Recent Search in Threat Center
- Create a New Saved Search in Threat Center
- Run a Saved Search in Threat Center
- Edit a Saved Search in Threat Center
- Delete a Saved Search in Threat Center
- Sort Cases or Alerts
- View Case and Alert Metrics
- Get Notified About Threat Center
Case Stages
Case stages indicate where you are in your response to a threat.
Case stages are defined points in a response workflow. As you work on a case, you change the case stage to track your progress and keep your team updated.
To manage stages, you must have the read, write, and delete permission for Threat Center cases. Navigate to Settings > Customizations > Manage Stages. View information about your stages, including:
Order – The order in which cases progress through the stages.
Stage Name – The name of the stage.
Type – Who created the stage.
Updated On – The date and time the stage was created or last reordered.
You can create your own stages. After you create a stage, you can reorder or delete it.
By default, there are four pre-built stages:
New – The case was created but nobody has responded yet.
Investigation – Somebody is actively investigating the case.
Remediation – Somebody is actively remediating the case.
Closed – Work has finished on the case.
Pre-built stages have 
under the Type column. The Closed stage is always the last stage in the workflow. You can't reorder or delete it. You can reorder or delete all other pre-built stages.
You can't rename stages. To correct an error in a stage name, you must delete the stage with the error and create a new stage with the correct name.