Which action helps you track case stages and compute elapsed time with minimal overhead?

• A. Detection rule logic to capture event fields and stage metrics
• B. Write a job to check case progress and update notes with timestamps
• C. Configure Case Stages in SOAR settings and use the Change Case Stage action in playbooks to capture metrics
• D. Create a SOAR dashboard that displays actions run, identifies stage, and calculates elapsed time

Answer: (C)

Tracking case progress with minimal overhead relies on using the platform’s built-in lifecycle features. Configuring Case Stages in SOAR settings and using the Change Case Stage action in your playbooks ensures every transition between stages is automatically recorded with timestamps as part of the case history. This lets you compute elapsed time between stages and across the entire lifecycle without writing extra code or separate jobs. It centralizes metrics in the case metadata, provides a reliable audit trail, and reduces maintenance because no external scripts or manual notes are needed.

Other approaches add overhead or risk drift. Manually checking progress and updating notes with timestamps requires custom development and ongoing maintenance. Building detection rule logic to capture fields and stage metrics can be brittle and may miss transitions or introduce complexity. A dashboard improves visibility but still depends on underlying stage changes being captured; it doesn’t inherently minimize the data capture work.