> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues.md). # Cases and issues - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases.md): Learn the core concepts and lifecycle of Cortex Cloud cases. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/what-are-cases.md): Understand how Cortex Cloud groups related security activity into cases. - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/resolving-cases-with-ai.md): Use AI capabilities to investigate and resolve cases. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-lifecycle.md): Understand the stages and status changes in a case lifecycle. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-thresholds.md): Learn how case thresholds determine when cases are created. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-scope-and-impact.md): Understand how case scope and impact help prioritize investigations. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-and-issue-domains.md): Learn how domains organize cases and issues by security area. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/overview-of-case-teams-and-roles.md): Understand case teams and the roles that support investigations. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts.md): Learn the concepts that govern cases, issues, and investigations. - [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/issues-findings-and-events.md): Understand the relationship between issues, findings, and events. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/case-grouping.md): Learn how Cortex Cloud groups related issues into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/case-scoring.md): Understand how Cortex Cloud calculates case scores. - [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/what-is-causality.md): Learn how causality connects related events during investigations. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/review-all-cases.md): Review and filter cases across your environment. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/start-case-analysis.md): Begin analyzing a case from the Cases page. - [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to analyze a case. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context.md): Gather and review the context needed to investigate a case. - [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Use AI-generated summaries to quickly understand case details. - [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Review and adjust a case's severity and score. - [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update case attributes to keep investigations accurate. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md): Examine evidence, issues, and related data in a case. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to explore related case activity. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence associated with a case. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Review issues associated with a case. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review MITRE ATT\&CK tactics and techniques in a case. - [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls associated with a case. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review chronological activity and events in a case. - [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Open a detailed view of case evidence and activity. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case.md): Resolve a case and record its outcome. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to manage case resolution tasks. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments to collaborate on a case. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Complete the steps required to resolve a case. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for resolved cases and issues. - [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Track case resolution times against defined goals. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions.md): Perform additional actions to manage and organize cases. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case for a security investigation. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign a case team and restrict case access. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Review playbook examples for case teams and access restrictions. - [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response.md): Investigate issues, findings, and assets, then automate response actions. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues.md): Cortex Cloud generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): Review and manage security issues from the Issues page. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-card.md): Understand the information displayed on an issue card. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/resolution-actions.md): Resolve, close, or otherwise act on an issue. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Link issues to a case or remove existing links. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Run an automation directly from an issue. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room to collaborate during an issue investigation. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): Use the Work Plan to track investigation tasks. - [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-deduplication.md): Understand how Cortex Cloud identifies and merges duplicate issues. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions.md): Use actions to manage and investigate issues. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy an issue to create a new investigation record. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update fields on one or more issues. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from further investigation. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data using XQL. - [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-syncing.md): Configure and monitor synchronization of issues with external systems. - [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status. - [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/review-findings/findings-card.md): Understand the information displayed on a finding card. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate an IP address and its related activity. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related security data. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate a file or process hash. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md): Investigate a user and related security activity. - [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant.md): Cortex Assistant is designed to streamline processes by simplifying case triaging, investigation, and remediation. It enables you to seamlessly uncover new insights on hashes, hosts, and more. You can - [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-layout.md): Understand the Cortex Assistant interface and layout. - [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md): Explore Cortex Assistant capabilities for investigations and response. - [Automation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation.md): Automate investigation and response workflows using Cortex Cloud automation. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/quick-actions.md): Run Quick Actions to respond to cases and issues. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/automation-exclusion-center.md): Manage automation exclusions for cases and issues. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md): Create and manage policies that exclude automation runs. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks.md): Create, manage, and run playbooks for automated response. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/playbooks-overview.md): Learn how playbooks automate investigation and response workflows. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/access-to-playbooks.md): Control access to playbooks and their content. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/playbook-development-checklist.md): Use a checklist to plan and build effective playbooks. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/plan-your-playbook.md): Plan a playbook before building its tasks and logic. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/manage-playbooks.md): Manage existing playbooks and their settings. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md): Build a playbook by adding tasks, inputs, and logic. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Start with an existing playbook or create a new one. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook details, inputs, and settings. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add Task Library objects to a playbook. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts to a playbook. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse workflows. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to a playbook. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex Cloud. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/create-a-section-header.md): Add section headers to organize playbook tasks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how playbooks handle script errors. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior with loops, filters, and transformers. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure a loop that runs a sub-playbook repeatedly. - [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data used by playbook tasks. - [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand built-in filters and filter design considerations. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand built-in transformers and transformer design considerations. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Add data to the playbook context. - [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from playbook data. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields with playbook tasks. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Identify and resolve playbook performance issues. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage playbook inputs, outputs, and task content. - [Accelerate playbook development using the Automation Engineer agent (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview.md): Use the Automation Engineer agent to accelerate playbook development. - [Automation Engineer prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview/automation-engineer-prompt-examples.md): Review prompt examples for the Automation Engineer agent. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/best-practices-for-playbooks.md): Apply best practices when designing and maintaining playbooks. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts.md): Create and manage AI prompts for automations. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts.md): Create, manage, and run scripts in Cortex Cloud. - [Access to scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/access-to-scripts.md): Control access to scripts and script content. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/use-existing-scripts.md): Find, review, and use existing scripts. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/create-a-script.md): Create a script to automate investigation or response tasks. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Automation Engineer agent to accelerate script development. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-an-integration-or-script.md): Change the Docker image used by an integration or script. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data.md): Use context data to assist with the investigation and remediation process. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/issue-context-data.md): View context data associated with an issue. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/case-context-data.md): View context data associated with a case. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/search-context-data.md): Search available context data. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-a-case.md): Add context data to a case. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/use-context-data-in-a-playbook.md): Use context data in a playbook. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists.md): Create and manage lists for automation workflows. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/create-a-list.md): Create a list for use in scripts and playbooks. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/list-commands.md): Use commands to manage list contents. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/use-cases-json-lists.md): Use JSON lists in automation workflows. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/transform-a-list-into-an-array.md): Transform a list into an array for automation tasks. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations.md): Configure and manage integrations used by automation workflows. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/add-an-integration-instance.md): Add an integration instance for automation use. - [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the Cortex CLI. - [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/troubleshoot-integations.md): Troubleshoot integration configuration and execution issues. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/manage-credentials.md): Manage credentials used by integrations. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines.md): Install, manage, configure, and troubleshoot engines. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/what-is-an-engine.md): Learn how engines execute integrations, scripts, and playbooks. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine.md): Install, deploy and configure Cortex Cloud engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex Cloud engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions. - [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker questions for engines. - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues on Cortex Cloud engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for engines. - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder on an engine. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide.md): Apply Docker hardening guidance for Cortex Cloud engines. - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker network settings for an engine. - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md): Configure Docker images for hardened engine deployments. - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users. - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure memory limits without swap support. - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits for an engine. - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure CPU, PID, and file descriptor limits. - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify Docker hardening configurations. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex Cloud engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex Cloud engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex Cloud engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/manage-engines.md): Manage engines and load balancing groups. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex Cloud or directly on the remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines.md): Configure Cortex Cloud engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations). - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine to connect through a web proxy. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure an engine to reach the server without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for an engine. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for an engine. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations that run on Cortex Cloud engines. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started building XQL queries in the Query Builder. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use Query Builder interface features to build and refine queries. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply best practices when writing XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected results when querying field values. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query in the Query Builder. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and analyze XQL query results. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate search criteria into an XQL query. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results in a graph. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query data across all available entities. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and rerun queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Review Query Center fields and status information. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Review reference information for scheduled queries. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): Cortex Cloud provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/xql-macros.md): Learn how XQL macros simplify reusable query logic. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md): Create and manage XQL macros. - [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions. - [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues.md): Customize your cases and issues for specific requirements. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/set-up-case-scoring.md): Configure how Cortex Cloud calculates case scores. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-a-starring-configuration.md): Create a starring configuration to prioritize important cases and issues. - [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals. - [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create additional case timers and service level agreements. - [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Update fields used by case timers and SLAs. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules. - [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create an issue exception rule from an issue. - [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View and manage issue exception rules. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable issue exception rules that are no longer needed. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View issues covered by an active exception rule. - [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-a-sync-profile.md): Create a sync profile for external issue management systems. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.