> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md).

# Overview of the Issues page

The **Issues** page consolidates all non-informational issues from your detection sources. By default, the **Issues** page displays the security issues received over the last seven days. To access the **Issues** page, go to **Cases & Issues** → **Issues**.

Each issue is linked to one or more cases. A case provides the full story of a problem by linking related issues, assets, and artifacts in one place. To make sure that you understand the full picture of how an issue fits into the bigger picture, we recommend that you start your investigation from the **Cases** page. You can see the issues linked to a case in the **Issues & Insights** tab of the selected case.

For issues associated with the Health domain, these issues are not linked to cases and should be investigated individually. You can also see Health domain issues on the **Health Issues** page.

{% hint style="info" %}

### Note

Every 12 hours, the system enforces a cleanup policy to remove the oldest issues once the maximum limit is exceeded. The default issue retention period in Cortex Cloud is 186 days.
{% endhint %}

<details>

<summary>Standardized format of user names in issues</summary>

Cortex Cloud processes and displays the names of users in the following standardized format, also termed “normalized user”.

***`<company domain>`*****`\`*****`<username>`***

As a result, any issue triggered based on network, authentication, or login events displays the **User Name** in the standardized format in the **Issues** and **Cases** pages.

</details>

<details>

<summary>Deduplicated FW issues</summary>

To reduce noise in your environment, if firewall issues with the same name and host are raised within 24 hours, the issues are deduplicated. A label indicates the number of deduplicated issues up to 1,000 issue counts, larger quantities display as 1000+.

</details>

<details>

<summary>Issue fields</summary>

To see a full list of issue fields and descriptions, run the following query in the **Query Builder**:

```programlisting
datamodel dataset = issues
```

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.