> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats.md). # Detect, Investigate, and Respond to Threats - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports.md): Monitor security dashboards and reports in Cortex AgentiX. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn how dashboards, reports, and widgets visualize security data in Cortex AgentiX. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Learn the dashboard interface and navigation controls in Cortex AgentiX. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Understand dashboard types and their uses in Cortex AgentiX. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports summarize and deliver security data in Cortex AgentiX. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Explore the Widget Library for dashboards and reports in Cortex AgentiX. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Manage dashboard and report access, visibility, and sharing in Cortex AgentiX. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure visibility settings for dashboards and reports in Cortex AgentiX. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Control user access to dashboard widgets in Cortex AgentiX. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand dashboard and report sharing icons in Cortex AgentiX. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Use this cheat sheet to manage dashboard and report access in Cortex AgentiX. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboards, reports, templates, ownership, and content in Cortex AgentiX. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to organize and manage dashboards in Cortex AgentiX. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): Manage reports and report templates in Cortex AgentiX. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Duplicate dashboards and reports to reuse security visualizations in Cortex AgentiX. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates in Cortex AgentiX. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Change dashboard and report template ownership in Cortex AgentiX. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates in Cortex AgentiX. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Configure notifications for failed reports in Cortex AgentiX. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboard and report content in Cortex AgentiX. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards.md): Create dashboards to visualize security data in Cortex AgentiX. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Create a custom dashboard to monitor security data in Cortex AgentiX. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports.md): Create reports to share security insights in Cortex AgentiX. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Create a custom report template from scratch in Cortex AgentiX. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration.md): Configure advanced dashboard and report features in Cortex AgentiX. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets for dashboards and reports in Cortex AgentiX. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Create dashboard widgets using AI in Cortex AgentiX. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Create XQL widgets to visualize query data in Cortex AgentiX. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add parameters to custom XQL widgets in Cortex AgentiX. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create script-based widgets for dashboards in Cortex AgentiX. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Configure global filters for dashboards in Cortex AgentiX. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure dashboard drilldowns for deeper investigation in Cortex AgentiX. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference.md): Reference system dashboards and Command Center dashboards in Cortex AgentiX. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference Command Center dashboards for security operations in Cortex AgentiX. - [Cortex Agentic Assistant dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-agentic-assistant-dashboard.md): Monitor Agentic Assistant activity with its dashboard in Cortex AgentiX. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Use Cortex Cloud Command Center dashboards in Cortex AgentiX. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference system dashboards available in Cortex AgentiX. - [Cortex Cloud Consumption](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cortex-cloud-consumption.md): Monitor Cortex Cloud consumption with this system dashboard in Cortex AgentiX. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations with this system dashboard in Cortex AgentiX. - [Investigation and Response](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response.md): Investigate cases and issues, run XQL queries, and respond to threats in Cortex AgentiX. - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases.md): Understand case investigation, triage, and response workflows in Cortex AgentiX. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/what-are-cases.md): A case provides the full contextual story of a problem that impacts your organization's security, giving you an end-to-end view of the problem and streamlining your understanding of what needs to be s - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/resolving-cases-with-ai.md): Use AI to analyze, investigate, and resolve security cases in Cortex AgentiX. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-lifecycle.md): Understand case lifecycle stages from creation through resolution in Cortex AgentiX. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-thresholds.md): Configure case grouping thresholds to keep investigations manageable in Cortex AgentiX. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-scope-and-impact.md): Assess case scope, impact, severity, score, and domain in Cortex AgentiX. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-and-issue-domains.md): Organize cases and issues with domains in Cortex AgentiX. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/overview-of-case-teams-and-roles.md): Understand case teams and roles for collaborative investigations in Cortex AgentiX. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts.md): Learn core case concepts for managing investigations in Cortex AgentiX. - [Issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues.md): Understand how issues identify security risks within Cortex AgentiX cases. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping.md): Learn how Cortex AgentiX groups related issues into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-scoring.md): Understand case scoring methods for prioritizing investigations in Cortex AgentiX. - [Case starring](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-starring.md): Star and filter important cases to prioritize work in Cortex AgentiX. - [SLAs and tracking](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/slas-and-tracking.md): You can set up Service Level Agreements (SLAs) to track your cases against SLA targets. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases.md): Review, analyze, and resolve security cases in Cortex AgentiX. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/review-all-cases.md): Review and prioritize open security cases in Cortex AgentiX. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis.md): Start case analysis and resolution workflows in Cortex AgentiX. - [Agentic Assistant - Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to analyze cases in Cortex AgentiX. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context.md): Establish investigation context for a security case in Cortex AgentiX. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details.md): You can analyze detailed information about the case in the Overview section of the Case card. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to analyze related case activity in Cortex AgentiX. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review case evidence to support investigations in Cortex AgentiX. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Analyze the issue feed for case investigation context in Cortex AgentiX. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Investigate assets and artifacts associated with a case in Cortex AgentiX. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review MITRE ATT\&CK tactics and techniques for cases in Cortex AgentiX. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Use the case timeline to review investigation activity in Cortex AgentiX. - [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Use the detailed view to investigate case information in Cortex AgentiX. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case.md): You can start remediating a case by reviewing the actions in the Resolution Center. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to plan and execute case remediation in Cortex AgentiX. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add collaborative notes and comments to cases in Cortex AgentiX. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Resolve a security case using guided response actions in Cortex AgentiX. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Configure resolution reasons for cases and issues in Cortex AgentiX. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions.md): Perform additional case management actions in Cortex AgentiX. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): You can manually create a new case, assign it to a specific domain, and define custom fields for the case. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases to streamline investigations in Cortex AgentiX. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign case teams and restrict case access in Cortex AgentiX. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Use playbook examples to manage case teams in Cortex AgentiX. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues.md): Cortex AgentiX generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): The Issues page consolidates all non-informational issues from your detection sources. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-card.md): On the Issue card, you can see details of the selected issue and take actions on an issue. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/resolution-actions.md): See all recommended remediation actions for an issue on the Resolution tab. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Link or unlink issues from cases in Cortex AgentiX. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Save time and expense by using playbooks and Quick Actions to automatically investigate and take remedial action on issues. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room for real-time investigation into a case, to filter war room entries, and to disable indicator notifications. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): A Work Plan is a visual representation of the running playbook that is assigned to a case. Use it to monitor and manage a playbook workflow. - [Manage synced tickets in issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/manage-synced-tickets-in-issues.md): Manage synced external tickets for issues in Cortex AgentiX. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions.md): Perform issue investigation and management actions in Cortex AgentiX. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issues to support investigation workflows in Cortex AgentiX. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Investigate contributing events for an issue in Cortex AgentiX. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file from Cortex AgentiX. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from investigation workflows in Cortex AgentiX. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data with XQL in Cortex AgentiX. - [Run indicator extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/run-indicator-extraction-in-the-cli.md): Run indicator extraction from the CLI in Cortex AgentiX. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update issue fields during investigations in Cortex AgentiX. - [Close an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md): Close resolved issues in Cortex AgentiX. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets.md): Investigate security artifacts and assets in Cortex AgentiX. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate IP address activity, cases, and intelligence in Cortex AgentiX. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate file and process hashes in Cortex AgentiX. - [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat.md): Use natural-language chat with the Cortex Agentic Assistant in Cortex AgentiX. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable and access Agentic Assistant chat in Cortex AgentiX. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom chat agent in Cortex AgentiX. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Use effective prompts with Agentic Assistant chat in Cortex AgentiX. - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Chat with an Agentic Assistant agent from Slack in Cortex AgentiX. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Use natural language in Cortex Agentic Assistant Chat to automatically generate and execute Cortex Query Language (XQL) queries in Cortex AgentiX. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings in Cortex AgentiX. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant in Cortex AgentiX. - [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence.md): Research threats, investigate indicators, and apply intelligence across Cortex AgentiX workflows. - [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/xti-threat-intel-library.md): Research threat actors, malware, vulnerabilities, and reports in Cortex AgentiX. - [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators in Cortex AgentiX. - [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings in Cortex AgentiX cases and issues. - [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Query XTI indicators, threat objects, and their relationships using Cortex Query Language in Cortex AgentiX. - [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-dashboard.md): Visualize threat intelligence data to monitor distribution, ingestion health, and emerging trends in Cortex AgentiX. - [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Threat Intel Agent to list, enrich, and update XTI indicators in Cortex AgentiX. - [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/using-xti-in-playbooks.md): Automate XTI indicator triage, enrichment, and response with supported playbook commands in Cortex AgentiX. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management.md): Manage, configure, and investigate threat indicators in Cortex AgentiX. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management investigations in Cortex AgentiX. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Understand Threat Intel Management and its capabilities in Cortex AgentiX. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex AgentiX. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Understand Threat Intel Management roles and responsibilities in Cortex AgentiX. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Understand indicator ingestion, enrichment, merging, and expiration in Cortex AgentiX. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Track indicators through their lifecycle in Cortex AgentiX. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicator types, fields, extraction, reputation, and exclusions in Cortex AgentiX. - [Customize indicator fields and types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types.md): Customize indicator fields, types, extraction, and expiration in Cortex AgentiX. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type.md): Create custom indicator types and configure enrichment behavior in Cortex AgentiX. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/indicator-type-profile.md): Configure indicator type profiles, scripts, commands, and expiration in Cortex AgentiX. - [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/file-indicators.md): Understand file indicator properties and hash handling in Cortex AgentiX. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/formatting-scripts.md): Format and validate indicator values with scripts in Cortex AgentiX. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/enhancement-scripts.md): Use enhancement scripts to enrich indicators in Cortex AgentiX. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-scripts.md): Use reputation scripts to calculate indicator verdicts in Cortex AgentiX. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-commands.md): Use reputation commands to retrieve indicator verdicts in Cortex AgentiX. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/map-custom-indicator-fields.md): Map enrichment context to custom indicator fields in Cortex AgentiX. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field.md): Create custom indicator fields for indicator types in Cortex AgentiX. - [Indicator field structure](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-structure.md): Reference indicator field structures and supported types in Cortex AgentiX. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-trigger-scripts.md): Configure scripts that run when indicator fields change in Cortex AgentiX. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Understand indicator classification and mapping in Cortex AgentiX. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators from issue fields in Cortex AgentiX. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set indicator extraction modes for playbook tasks in Cortex AgentiX. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable automatic indicator extraction for scripts or integrations in Cortex AgentiX. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure default indicator expiration settings in Cortex AgentiX. - [Configure Threat Intelligence feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-feed-integrations.md): Configure threat intelligence feed integrations in Cortex AgentiX. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from automated enrichment in Cortex AgentiX. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/export-indicators.md): Export indicators and configure external dynamic lists in Cortex AgentiX. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/manage-external-dynamic-lists.md): Manage external dynamic lists in Cortex AgentiX. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Create, edit, search, export, and delete indicators in Cortex AgentiX. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators and manage their relationships in Cortex AgentiX. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Configure and review indicator verdicts in Cortex AgentiX. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators during investigations in Cortex AgentiX. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators through the CLI or UI in Cortex AgentiX. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Create and manage indicator relationships in Cortex AgentiX. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete indicators and manage indicator exclusions in Cortex AgentiX. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.