> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues.md). # Issues Understand how issues identify security risks within Cortex AgentiX cases. Issues identify the problems that you need to solve in your environment. Cortex AgentiX creates issues when problems occur in your environment that cross defined thresholds, or surpass your organization's accepted level of risk and threat tolerance. Each issue comprises a defined framework of: * **What happened:** A description of the problem * **How is your environment impacted:** Affected assets or the impact of this issue in your environment * **Contributing evidence:** Data that supports our analysis and observations * **Recommended actions:** Automations, playbooks, and manual suggestions Issues are created from events that occur in your environment. When an issue is created, Cortex AgentiX assesses the content of the issue and assigns it to a new or existing case. In addition, according to the content of the issue, it is assigned to a domain that reflects the operational use case of the issue, such as **Security** or **Health**. Using case grouping logic, Cortex AgentiX then determines whether to link the issue to a case. When you open a case, you can see all issues that are linked to the case. Review the **Grouping graph** to see why the issues were grouped together in the case. For more information about how issues are grouped in cases, see [Case grouping](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping.md). In addition, Cortex AgentiX offers the flexibility to: * Mirror Cortex issues with external applications (for example, Atlassian Jira). For more information, see [Issue syncing](/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/issue-syncing.md). * Create issues from custom rules that you define. For example, correlation rules. For more information about setting up rules, see [What's a correlation rule?](/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.