> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/detect-and-respond-mdr/self-hosted-soc/phase-4-resolution-and-closure.md).

# Phase 4: Resolution and Closure

Phase 4 finalises the case. Write the outcome description, verify all gates, set the
 verdict, and resolve. Closure is automated after a 7-day grace period. Once a ticket is closed it cannot be edited. A ticket in resolved can be commented/edited and it automatically is reopened with the relevant status.

## <mark style="color:$primary;">Step 1: Write the Case Description (Final Action)</mark>

Write a concise outcome summary in the Description field. Cover:

* What happened: a factual account of the incident
* How it happened: root cause or attack path
* Actions taken: what was done during investigation and response, including any
  &#x20;actions carried out in external tools
* Recommendations: what should be done to prevent recurrence

{% hint style="info" %}

#### Rule: Description vs Timeline

The Description holds the outcome, not the investigation. The timeline holds all investigation detail.

Write a clean, concise summary suitable for the customer and for audit. Do not copy investigation notes into the description.
{% endhint %}

## <mark style="color:$primary;">Step 2: Run the Final Validation Checklist</mark>

<table><thead><tr><th width="93.5" data-type="checkbox">Check</th><th width="258">Item</th><th>Status</th></tr></thead><tbody><tr><td>true</td><td>All artefacts assessed</td><td>Required, platform enforced</td></tr><tr><td>true</td><td>Category and Subcategory updated</td><td>Required, platform enforced</td></tr><tr><td>true</td><td>MITRE mapping accurate (where applicable)</td><td>Required, where applicable</td></tr><tr><td>true</td><td>Internal notes and comments complete</td><td>Required</td></tr><tr><td>true</td><td>Timeline is clear and coherent</td><td>Required</td></tr><tr><td>true</td><td>External response actions documented in Internal Notes</td><td>Required</td></tr><tr><td>true</td><td>Description written and accurate</td><td>Required, last action</td></tr></tbody></table>

## <mark style="color:$primary;">Step 3: Resolve the Case</mark>

Set the verdict and update the status to Resolved:

* True Positive: a real, confirmed threat or security incident
* False Positive: a benign or incorrectly-triggered incident

{% hint style="info" %}

#### Analysts Cannot Close Cases

Analysts cannot manually move cases to Closed. Closure is automated after 7 days. Any activity on a Resolved case automatically reopens it to Processing.
{% endhint %}

## <mark style="color:$primary;">Step 4: Closure Lifecycle: Automated</mark>

<table><thead><tr><th width="95.5">State</th><th width="176">Timing</th><th>Permissions</th><th>Notes</th></tr></thead><tbody><tr><td>Resolved</td><td>Set by analyst</td><td>Category and incident info can still be updated. Any activity reopens the case</td><td>Analyst review period</td></tr><tr><td>Closed</td><td>After 7 days in Resolved</td><td>Read-only. No manual transition allowed</td><td>Fully closed, automated</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/modules/detect-and-respond-mdr/self-hosted-soc/phase-4-resolution-and-closure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.