What a category is
A case category is a named kind of incident with two attachments: the headings a write-up for that kind should have, and the tasks that kind usually needs. Choosing the category at case creation seeds both.
Seed categories
The platform ships with categories for the incidents a SOC sees most, among them malware on an endpoint, credential theft, phishing, unauthorised access, data exfiltration, denial of service, policy violation and a general category for everything else. Each comes with a task template you will want to edit for your environment.
Managing categories
Settings › Case categories. Add, rename or retire categories; edit the write-up headings and the task template. Changes apply to new cases; existing cases keep the tasks they were created with.