> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/case-and-issue-lifecycle.md). # Case and issue lifecycle Cortex AgentiX uses the following for structured containers for all actionable security issues: * Issues Issues identify the problems that you need to solve in your environment. Cortex AgentiX creates issues when problems occur in your environment that cross defined thresholds or surpass your organization's accepted level of risk and threat tolerance. Issues are the primary focus of autonomous actions. There are several issue triggers, including: * SIEM issues * Mail issues * Security issues These issues are generated from third-party services, such as SIEMs, mailboxes, and data. * Cases Cases are a workbench for resolving security problems in your environment. Each case groups related issues, highlights the impacted assets, and provides essential data in one place. Cases help you stay focused on threats and risks that have the most impact on the organization's security, help you reduce noise in your environment, and guide you to resolution using automation actions that reduce time and effort. Cases serve as a broader, overarching container for complex or prolonged security investigations, capable of encompassing multiple related Issues over time, providing a holistic view and serving as a central point for intricate or multi-stage security incidents. For more information about cases and issues in Cortex AgentiX, see [Investigation and Response](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response.md). Cortex AgentiX includes several out-of-the-box cases and issue types, fields, and layouts, some of which can be customized to suit your use case. You can also create custom fields and layouts as necessary. Cases can be created manually, from an API, or from an integration feed. You can define integrations with your third-party security and incident management vendors. You can trigger events from these integrations that become cases/issues in Cortex AgentiX. You can run playbooks on these cases/issues to enrich them with information from other products in your system, which helps you complete the picture. **Planning** Before you begin configuring integrations and ingesting information from third parties, consider the following: | Phase | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data ingestion | Data ingestion is the entry point of all security data into Cortex AgentiX, which relies on integrations to pull in alerts, events, and data from third-party sources. Configure integrations with third-party products to start fetching events, such as potential phishing emails, authentication attempts, and SIEM events. For more information, see [Content configuration](broken://spaces/ocwvgxtzkvBHMLbPsZuG/pages/qsa45c1XIsF6b4wQc2vz). | | Configure correlation rules |

Correlation rules are logic-driven rules that detect complex attack patterns by analyzing relationships and behaviors across data sources and events, such as:

For example, you may want to set up a correlation rule to generate a single issue where a user triggers five or more failed login events from the same source IP within 10 minutes, or if multiple failed logins are followed by a successful login, raise a higher severity issue.

NOTE: You don't always need to create a parsing rule before a correlation rule. Some ingested data is pre-parsed.

For more information, see What's a correlation rule?.

| | Create case/issue domains |

Consider whether you want to create case domains for your use case.

Every organization has unique incident response plans, escalation matrices, and remediation steps. Customizing cases allows you to align the platform's workflow precisely with your established internal processes. For example, a cyber incident response domain or a compliance and risk management domain. SOC analysts focus on active threats (cyber incident response), and GRC teams handle long-term risk (compliance and risk management).

For more information, see Case and issue domains.

| | Fields and layouts |

Customize Cortex AgentiX security investigations by tailoring precisely to an organization's specific operational needs, workflows, and reporting requirements. This ensures the platform truly reflects the unique context of each SOC.

SOC engineers can create and manage unique data fields essential for capturing specific information (for example, business impact rating, affected Department, and design the visual presentation of an issue or case.

Cortex AgentiX relies on these definitions to understand what information to collect, where to store it, and how to present its findings, while human analysts interact with these structured views for efficient collaboration and oversight.

For more information, see Customize your cases.

| | Playbooks | Configure playbooks for automated handling, enrichment, and disposition of issues once they are created. Set up triggers to run a playbook on an issue. For more information, see [Automations](/cortex-agentix/configure-cortex-agentix/automations.md). | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/case-and-issue-lifecycle.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.