Containers can be promoted to cases. You can use cases to consolidate information from multiple containers.

• Cases have phases and tasks, which are organized into workbooks to track and manage all the actions taken.
• Tasks can have playbooks and actions associated with them, allowing you to automate these actions. Automating actions allows Splunk SOAR (On-premises) to be used to track policy and compliance, and to fulfill documentation requirements.