diff --git a/thehive/app/org/thp/thehive/services/AlertSrv.scala b/thehive/app/org/thp/thehive/services/AlertSrv.scala
index b9877b41e2..f4927bde2d 100644
--- a/thehive/app/org/thp/thehive/services/AlertSrv.scala
+++ b/thehive/app/org/thp/thehive/services/AlertSrv.scala
@@ -276,17 +276,16 @@ class AlertSrv @Inject() (
   def mergeInCase(alert: Alert with Entity, `case`: Case with Entity)(implicit graph: Graph, authContext: AuthContext): Try[Case with Entity] =
     auditSrv
       .mergeAudits {
+        // No audit for markAsRead and observables
+        // Audits for customFields, description and tags
         val description = `case`.description + s"\n  \n#### Merged with alert #${alert.sourceRef} ${alert.title}\n\n${alert.description.trim}"
-
         for {
           _ <- markAsRead(alert._id)
           _ <- importObservables(alert, `case`)
           _ <- importCustomFields(alert, `case`)
-          _ <- caseSrv.get(`case`).update(_.description, description).getOrFail("Case")
           _ <- caseSrv.addTags(`case`, get(alert).tags.toSeq.map(_.toString).toSet)
-          // No audit for markAsRead and observables
-          // Audits for customFields, description and tags
-          c <- caseSrv.getOrFail(`case`._id)
+          _ <- alertCaseSrv.create(AlertCase(), alert, `case`)
+          c <- caseSrv.get(`case`).update(_.description, description).getOrFail("Case")
           details <- Success(
             Json.obj(
               "customFields" -> get(alert).richCustomFields.toSeq.map(_.toOutput.toJson),