Detailed view

Use the detailed view to investigate case information in Cortex AgentiX.

The Detailed View in the case card provides a table-based format and custom layouts, ensuring full backward compatibility. You can switch between the Overview and the Detailed View based on your workflow preferences.

The Detailed View supports deep inspection and manual analysis while maintaining access to the same underlying case data. It includes the following tabs:

Tab	Description
Issues & Insights	Displays a list of issues and insights linked to the case. Click on an issue or insight to open the issue card.
Key Assets & Artifacts	Displays asset and artifact information of the key artifacts, hosts, and users associated with the case. Hover over an icon for more information, or click the more options icon to see the available views and actions. For more information about investigating key assets and artifacts, see Investigate artifacts and assets.
Timeline	Displays a chronological representation of issues and actions relating to the case. Each timeline entry represents a type of action that was triggered in the issue. Issues that include the same artifacts are grouped into one timeline entry and display the common artifact in an interactive link. Click on an entry to view additional details in the Details pane. You can also filter the timeline by action type. Depending on the type of action, you can select the entry to further investigate and take action on it.
Case War Room	The Case War Room is a collection of the Active Response investigation actions, artifacts, and collaboration pieces for an issue or case. It is a chronological journal of the case investigation. You can run commands and playbooks from the War Room and filter the entries for easier viewing. The War Room facilitates real-time investigation. Powered by ChatOps, the War Room helps you perform different tasks related to their case investigation using CLI commands. For example, running real-time security actions through the CLI, without switching consoles, and running security playbooks, scripts, and commands. For more information, see Use the War Room in an investigation
Executions	Displays the causality chains associated with the case. On this tab, you can investigate a causality chain and take actions on a host. For more information, see Causality view.

Investigate issues and insights

The Issues & Insights tab displays a table of the issues and insights associated with the case.

1. Use the toggle to switch between issues and insights, and add filters to the table to refine the displayed entries.
2. Click an issue to open the issue investigation panel. This panel provides detailed information about an issue, enables you to take actions on an issue, open the causality, and start remediation.
3. If required, you can unlink the issue from the case or link it to other related cases. Click the more options icon and select Manage issue+Link to case or Unlink from case.

Note

When an issue is resolved, it remains linked to a case. Once all of the issues in a case are resolved, the case is automatically closed.

Run an automation on an issue

You can run or rerun an automation on one or more issues. If there is currently an automation running on one or more of the selected issues, the Run Automation option does not appear. If an automation is running on the issue, but has been paused (for example, waiting for a user action), you can select to rerun the automation or select a new automation.

1. In the Issues & Insights tab, right-click one or more issues and click Run Automation.
2. If the issues have an automation already assigned, choose Rerun current Automation or Choose another Automation. If the playbooks do not have an automation assigned, select a action to run and define the action parameters.
3. Run the automation.

Investigate key assets and artifacts

The Key Assets & Artifacts tab displays all the case assets and artifact information of hosts, users, and key artifacts associated with the case.

1. Investigate artifacts.

   In the Artifacts section, review the artifacts associated with the case. Each artifact displays, if available, the artifact information and available actions according to the type of artifact: File, IP Address, and Domain.
2. Investigate hosts.

   In the Hosts section, review the hosts associated with the case. Each host displays, if available, host information and available actions.

   To further investigate the host, select the host name to display the Details panel. The panel is only available for hosts with the agent installed and displays the host name, whether it’s connected, along with the Endpoint Details, Agent Details, Network, and Policy information details. If the Details panel is not available, click the more options icon next to a host name to see the available options.
3. Investigate users.

   In the Users section, review the users associated with the case. Each user displays, if available, the user information and available actions

Investigate the case timeline

The Timeline tab is a chronological representation of issues and actions relating to the case.

1. Navigate to the Timeline tab and filter the actions according to the action type.
2. Investigate a timeline entry.

   Each timeline entry is a representation of a type of action that was triggered in the issue. Issues that include the same artifacts are grouped into one timeline entry and display the common artifact in an interactive link. Depending on the type of action, you can select the entry, host names, and artifacts to further investigate the action:

   • Locate the action you want to investigate:

     • For Quick Actions and Case Management Actions, you can add and view comments relating to the action.
     • For Issues, click the action to open the Details panel. In the panel, go to the Issues tab to view the issues table filtered by issues ID, the Key Assets to view a list of Hosts and Users associated to the issue, and an option to add Comments.
   • Select the Host name to display the endpoint data, if available.
   • Select the Artifact to display the following type of information:

     • Hash artifact: Displays the Verdict, File name, and Signature status of the hash value. Select the hash value to view the Wildfire Analysis Report, Add to Block list, Add to Allow list and Search file.
     • Domain artifact: Displays the IP address and VT score of the domain. Select the domain name to Add to EDL.
     • IP address: Display whether the IP address is Internal or External, the Whois findings, and the VT score. Expand Whois to view the findings and Add to EDL.
   • In action entries that involved more artifacts, expand Additional artifacts found to further investigate.

Investigate case executions

The Executions tab displays all the causality chains associated with the case. The causality chains are aggregated according to the following types of groupings:

• Host Name

  • Host with an agent installed
  • Host without an agent installed
  • Multiple Hosts
  • Undetected Host
• User Name

  • Username
  • Multiple Users
  • Undetected Users

Note

• Cloud-related issues are displayed in the User Name grouping.
• Prisma Cloud Compute issues are displayed in the Host Name grouping.

How to investigate case executions

1. Investigate the host causality chains.

   In the Executions section, review the hosts associated with the case. Review the host information and click the more options icon to perform actions on the host, or open related views.
2. Investigate a causality chain.

   The causality chains are listed according to the Causality Group Owner (CGO), expand the CGO card you want to investigate. Each CGO card displays the CGO name, the following CGO event details, and the causality chain:

   • CGO Name
   • Issue Sources associated with the entire causality chain
   • Execution time of the causality chain
   • Number of issues that include the CGO according to severity.

   Expand the causality chain to investigate and perform available Causality View actions. For more information, see Causality view.

Issue card

The Issue card provides a full breakdown of an issue, helping you understand the root cause and take action through relevant evidence, remediation guidance, and response options.

The issue card supports full case investigation by retaining case context. Once you have finished reviewing an issue, close the card to return to the initial case investigation.

Each issue card adapts to the type of issue you’re investigating, surfacing the most relevant information and tools at every stage of the workflow. While layouts may vary, most issues share a common set of tabs designed to support triage, investigation, and resolution.

Tab	Description
Overview	Displays a description of the issue and provides key information, including: Assignee Status Time at which the issue was created and updated Suggested automations to run on the issue. Click the automation to open to the Work Plan tab with details of the automation. Affected Assets with links to the affected asset cards Cases linked to the issue If an automation rule triggered an automation (Quick Action, playbook, or agentic agent) to run on the issue, the name of the last automation to run on the issue is displayed. The Evidence section contains information to help you investigate the issue, such as the causality chain. Note This section is context-specific and shows data according to the issue context.
Resolution	Displays recommended remediation actions, and pending, in progress, and completed actions. For more information, see Resolution actions.
Issue Information	Displays a summary of the issue, such as issue details , indicators, and outstanding tasks. Some fields are informational and some can be edited. Includes the following sections (depending on the layout): ISSUE DETAILS: A summary of the issue, such as type, severity, and when the issue occurred. You can update these fields as required. COMMAND AND TASK RESULTS: Lists any manual commands and playbook task results. WORK PLAN: View or take action on the following: Playbook tasks: When a playbook runs, any outstanding tasks appear. You can take various actions here or in the Work Plan tab. To-Do Tasks: An ad-hoc item that is not attached to the Work Plan. Create tasks for users to complete as part of an investigation. These are like a To-Do list that you keep in an investigation on an ad-hoc basis, rather than the Work Plan, which follows a pre-defined process. You can view or create To-Do tasks. NOTES: Helps you understand specific actions taken, and allows you to view conversations between analysts to see how they arrived at a certain decision. You can see the thought process behind identifying key evidence and identifying similar cases. MALICIOUS OR SUSPICIOUS INDICATORS: A list of any malicious or suspicious indicators. If you have the Threat Intel add-on, you can pivot to the Indicators page, where you can take further action on the indicator. Notice Requires the TIM add-on. INDICATORS HANDLING: Take actions on indicators from the displayed options.
Technical Information	Displays an overview of the information collected about the investigation, such as indicators, email information, URL screenshots, etc. When you run a playbook, the sections are automatically completed.
Investigation Tools	Enables you to take action on the issue, such as converting a JSON file to CSV and checking if the IP address is in CIDR.
War Room	A comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the issue investigation. Each issue has a unique War Room. For information, see Use the War Room in an investigation.
Work Plan	A visual representation of the running playbook that is assigned to the issue. For more information, see Use the Work Plan in an investigation.