Case and issue domains

Organize cases and issues with domains in Cortex AgentiX.

Depending on the objects identified in a case or issue, each case and issue is assigned to a domain that reflects the root cause and the system areas of operation.

Domains are a contextual boundary that allow you to manage and prioritize each use case and help you to differentiate between your security use cases and non-security use cases. Domains help you to organize and manage your work efforts, streamline the assignment of cases, and enable you to create tailored experiences for each domain.

When an issue is created, Cortex AgentiX automatically assigns it to a domain, and the same domain is assigned to the associated case. If you create your own case, you can select the domain to which you want to assign it.

Each case and issue is assigned to a single domain. You cannot change the assigned domain, however cases can be linked to issues from different domains.

Built-in domains

Cortex AgentiX provides the following built-in domains:

Domain	Description
Security	For cases and issues that are associated with case response activities for detecting, preventing, and blocking threats as they occur in runtime. For example, the identification of malware in a file, a compromised endpoint, or a phishing attempt. These cases can be assigned to a SOC analyst who specializes in blocking and remediating attacks.
Health	For cases and issues that are associated with health monitoring activities, to ensure optimal platform performance and gain insights into health drifts. For example, disruptions in data ingestion, collector connectivity errors, correlation rule errors, and event forwarding errors.