| Code Value |
Definition |
| Active-Hot | The case is active, but not yet determined to be a threat. Requires constant attention. |
| Active-Routine | The case is active but not being proactively pursued. |
| Active-Threat | The case is active and determined to represent a threat . Requires total commitment of effort to monitor, track, and status. |
| Active-Watch | The case is active of sufficient interest to maintain on a watch list. |
| Closed-Error | The case has been determined to have been opened in error and has been closed. |
| Closed-Normal | The case has been closed. |
| Inactive | The case in no longer of interest, but a decision to close the case has not been made. |
| Merged | The case has been closed by merging into another case. |
| Pending | The case has been created, but will not become active until triggered by a date-time, event, or user action. |
| Suspended | The case is no longer active, but can be returned to an active state by a time or event trigger, or user action. |
| Unknown | The case status is unknown. |