> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md). # Use the War Room in an investigation The War Room contains an audit trail of all automatic or manual actions that take place in a case or issue. A War Room is where you can review and interact with your case or issue. Cortex Cloud provides machine learning insights to suggest the most effective analysts and command-sets. Each case and issue has a unique War Room.

Within Cortex Cloud, real-time investigation is facilitated through the War Room, which is powered by ChatOps. In the War Room you can take the following actions: * Run real-time security actions through the CLI, without switching consoles. * Run security playbooks, scripts, and commands. * Collaborate and execute remote actions across integrated products. * Capture case context from different sources. * Document all actions in one source. * Communicate with others for joint investigations. {% hint style="info" %} ### Note The case War Room is usually used for communication capabilities, but unlike the issue War Room, it does not include playbook specific entries. The case War Room enables you to investigate an entire case, not just an issue. {% endhint %} Every case has a War Room, but every user has access, subject to permissions, to a private War Room called the Playground. ### The Playground The Playground is a non-production environment where you can safely develop and test data, such as scripts, APIs, and commands. It is an investigation area that is not connected to a live (active) investigation. To access the Playground, do one of the following: * Go to **Investigation & Response** → **Automation** → **Playground**. * In any browser, type `https://..paloaltonetworks.com/playground`. {% hint style="info" %} ### Tip In the Playground, you can clear the context data, if needed, which deletes everything in the Playground context data, but does not affect the actual issue or case. To clear the context, run `!DeleteContext all=yes'` from the CLI or click **Clear Context Data** while viewing the context data. {% endhint %} ### The War Room When you open the War Room, you can see all the actions taken on a case, such as commands and notes in several formats such as Markdown, and HTML. When Markdown, HTML, or geographical information is received, the content is displayed in the relevant format. To view specific data entries, you can filter entries by selecting the relevant checkbox, such as: * **Chats**: Shows communication between team members. * **Notes**: Any entries marked as notes. * **Files**: Anything uploaded to the War Room in a playbook, script, or by the analyst. * **Issue History**: Any issue field that was modified. * **Commands and playbook tasks**: Any actions taken by playbook tasks or run manually by the analyst. * **Tags**: Any tags added to the investigation. {% hint style="info" %} ### Note Cortex Cloud does not index notes and chats. {% endhint %} In each War Room entry, you can take the following actions:

Action	Description
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. You can also add a note by doing the following: Upload a file to the War Room by selecting Mark as Note. If the Issue Overview tab includes a NOTES section, add it to the section. In a playbook task (Advanced tab) Tasks can be automatically added from script outputs as notes. In the CLI by running the `!markAsNote entryIDs=<ID of the war room entry>` command. In the relevant War Room entry, click Copy to CLI to retrieve the `ID of the War Room entry`. When marked as a note, it is highlighted, so you can easily find them in the War Room or the Issue Overview tab.
View artifact in new tab	Opens a new tab for the artifact.
Detach from task	Removes a task from the artifact.
Attach to a task	Adds a task to the artifact.
Add tags	Add any relevant tags to use that help you find relevant information.
Copy to CLI	ID: Entry IDs are used to uniquely identify War Room entries and take the format `<ENTRY_IDENTIFER>@<CASE_ID>`, for example, `54925dc3-a972-4489-8bef-793331fa6c77@1`. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. URL: Copy the URL which is a direct link to the War Room entry To find the entry ID or URL of an entry in the War Room, click on the vertical ellipsis icon at the upper right of the entry, then copy the value.

### Run Commands in the War Room CLI Cortex Cloud enables you to run system commands, integration commands, and scripts from an integrated command line interface (CLI), which enables you to make comments in your case (in plain text or Markdown) and to execute automation scripts, system commands, and integration commands. In the CLI, you can run various commands by typing the following:

Action	Description
`!`	Runs integration commands, scripts, and built-in commands, such as adding evidence and assigning an analyst.

You can find relevant commands, scripts, and arguments with the CLI’s auto-complete feature. This also includes fuzzy searching to help you find relevant commands based on keywords. If you type the exclamation mark (**!**) and start typing, autocomplete populates with options that might suit your needs. {% hint style="info" %} ### Tip You can use the up/down arrow buttons in the CLI to do a reverse history search for previous commands with the same prefix. {% endhint %}

Special characters

To use `\, \n, \t, \r, ", ^, :,` comma, and space, place them within single or double quotes and use an escape character `\`.

Common arguments

The following common arguments are available for every script run from the CLI.

Argument Name	Description
`auto-extract`	Whether or when to extract indicators. Possible values are `inline`, `outofBand`, and `none`.
`execution-password`	Supplies a password to run a password-protected script.
`execution-timeout`	Defines how long a command waits in seconds before it times out.
`extend-context`	Select which information from the raw JSON you want to add to the context data.
`ignore-outputs`	If set to `true`, it does not store outputs in the context besides extend context.
`raw-response`	If set to `true`, it returns the raw JSON result from the script.
`retry-count`	Determines how many times the script attempts to run before generating an error.
`retry-interval`	Determines the wait time in seconds between each script execution.
`using`	Selects which integration instance runs the command.
`using-brand`	Selects which integration runs the command.
`using-category`	Selects which category of integrations runs the command.

Access attributes in the Unified Asset Inventory

Commands you run in the War Room can automatically populate parameters such as region, account id, and tags, based on asset data. Commands can reference UIA attributes for the relevant asset or assets in the issue context and use those attributes as input. The issue must contain the relevant `Asset ID`. The syntax to reference attributes in the UAI is `${asset.xdm.asset.attributename}`. To find the property path in the XDM data set, see the asset data card for the asset in the **Inventory** page. For example, to print the region for the asset, enter `!print value=${asset.xdm.asset.cloud.region}`. You can also run commands and scripts directly on the asset using `${asset.xdm.asset}`.

Run commands in the Automations browser

You can view and run commands and scripts, but not system commands, operations, and notifications, in the **Automations Browser**, by clicking the exclamation icon next to the CLI. The **Automations Browser** enables you to run commands and all associated arguments. In each argument, you can hardcode the value or use a dynamic value.

Examples using the CLI

To run the print script with a value of `"hello"` and the key `a` from the context: ```programlisting !Print value="hello ${a}" ``` To run the Python command returning Hello World using escape characters: ```programlisting !py script="demisto.results(\"hello world\")" ``` To run the Python command returning Hello World using backticks: ```programlisting !py script=`demisto.results("hello world")` ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.