The benefits of using cases in Helix include the following:
Allows you to analyze related alerts as part of a whole, and combine all related information in one place for easy collaboration across team members.
Automatically enriches cases with any information that Trellix has on the events and alerts that form the case.
The Case Timeline shows all events and alerts taken on the case over a period of time. It gives both an overview of the whole case, and the ability to pivot to more detailed information on each part of the investigation.
Tracks all details of a case, which you can export in CSV or JSON format. All events, artifacts, and alerts associated with the case, and any notes created by the analysts working on the case can be exported. This allows SOC leaders to produce reports and show metrics to stakeholders.