Skip to content
Made in the UK

SIEM for MSPs

How does MDR case management work from alert to closure?

By , Head of SOC and IR, CybaVerse. Last reviewed

MDR case management turns related alerts into one case, which an analyst triages, investigates and contains, then hands over for remediation and recovery before it is resolved and closed. Every action is recorded on the case timeline, so the MSP, the client and the SOC share one history.

This page is part of our SIEM for MSPs guide.

What is an MDR case?

A case is the unit of work in MDR. Instead of handling each alert separately, related alerts about the same activity are grouped, so one attack becomes one case with one owner. NIST's incident response guidance describes the same idea: detect, analyse, contain, eradicate and recover as one managed incident.

How does a case move from alert to closure, step by step?

The steps below follow a typical case through an MDR platform. Status names vary between providers, so check the terms your provider uses. What matters for an MSP is that every stage has an owner, a record and a clear point where the case is handed over or closed.

  1. Step 1: Alert and grouping

    Detection rules raise alerts, and related alerts are grouped into a new case.

  2. Step 2: Triage

    An analyst checks whether the activity is real and how serious it is.

  3. Step 3: Investigation and containment

    The analyst investigates and takes any containment the client has pre-approved.

  4. Step 4: Remediation and recovery

    The root cause is fixed and systems are restored, often with the MSP.

  5. Step 5: Resolution and closure

    The case is resolved with a summary, then closed and kept for audit.

What statuses does a case go through?

Clear statuses tell everyone where a case stands without reading the whole history. The table uses common status names. Containment and recovery are not separate statuses; they are actions run against the open case and recorded on its timeline, so the status always reflects ownership.

StatusMeaning
NewCase created, awaiting triage
ProgressingUnder investigation or response
PendingWaiting on the MSP or client
ResolvedWork complete, summary written
ClosedKept for audit

Where does CybaOps fit in case management?

In CybaOps, incidents are worked as cases, with the evidence, comments and a timeline of actions kept together. The CybaVerse SOC works each case within the actions agreed for the client, and the MSP sees the same record, so handovers and reviews start from the same facts.

  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • CybaOps has role-based access control.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.
  • Pre-approved response actions are agreed with the MSP for each client during onboarding.

Case management

How an MDR case moves from alert to closure

MDR case management turns related alerts into one case, which an analyst triages, investigates and contains, then hands over for remediation and recovery before it is resolved and closed.

01 Detected by

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Case management

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • In
  • CybaCore
  • CybaEdge
  • CybaOne
  • CybaRemediate

What else do MSPs ask about MDR cases?

Can a closed case be reopened?

It depends on the platform. A common approach keeps closed cases unchanged for audit and opens a new related case if activity returns. Linking the two keeps the full history visible without altering the original record of what happened.

Who sees the case?

The MSP and the CybaVerse SOC work from the same case history. Agree with each client what they see. A shared record means everyone works from the same facts, and nobody has to piece the story together from separate emails.

How are clients updated?

Agree with each client how they are updated, for example through regular reports and your own service desk, and how critical incidents are escalated. Clear expectations help clients feel informed and make sure urgent issues reach the right person quickly.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

Related: How do MSPs run a SIEM without a 24/7 SOC? and What is OCSF and why does it matter for MSP log normalisation?

See the workflow on real data.

Book a CybaOps demo