> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues.md).

# Cases and issues

- [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases.md): Understand cases, their lifecycle, scope, impact, and ownership.
- [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/what-are-cases.md): Learn how cases group related security issues for investigation and response.
- [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/resolving-cases-with-ai.md): Use AI assistance to investigate and resolve security cases faster.
- [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-lifecycle.md): Understand the stages and status changes in a case lifecycle.
- [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-thresholds.md): Configure thresholds that determine when Cortex Cloud creates or updates cases.
- [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-scope-and-impact.md): Understand how case scope and impact reflect affected entities and risk.
- [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-and-issue-domains.md): Understand domains used to classify cases and issues.
- [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/overview-of-case-teams-and-roles.md): Learn how teams and roles organize investigation access and responsibilities.
- [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts.md): Learn the core concepts that define cases, issues, and investigation context.
- [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/issues-findings-and-events.md): Understand how issues, findings, and events contribute to case investigations.
- [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-grouping.md): Learn how Cortex Cloud groups related issues into cases.
- [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-scoring.md): Understand how case scores prioritize investigations by risk and severity.
- [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/what-is-causality.md): Understand causality relationships that connect events, assets, and security issues.
- [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases.
- [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/review-all-cases.md): View, filter, and prioritize cases across your environment.
- [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis.md): Begin a case investigation and assess its initial context.
- [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to accelerate AI-assisted case analysis.
- [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context.md): Build investigation context from case details, risk, and related activity.
- [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Use AI-generated summaries to understand case details and priorities quickly.
- [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Review and adjust case severity and score during an investigation.
- [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update case fields to keep investigation details accurate.
- [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md): Review case evidence, relationships, and activity to guide your investigation.
- [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Explore relationships among issues grouped within a case.
- [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence that supports the case investigation.
- [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Track issues and updates associated with a case.
- [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case.
- [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Map case activity to relevant MITRE ATT\&CK tactics and techniques.
- [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls related to a case.
- [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review a chronological view of case activity and updates.
- [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Open detailed case information for deeper analysis.
- [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case.md): Complete case resolution and document the investigation outcome.
- [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to manage and complete case resolution.
- [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments to collaborate during a case investigation.
- [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Follow the steps to resolve a case and record its outcome.
- [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for cases and issues.
- [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Monitor case resolution times against configured service-level objectives.
- [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions.md): Perform additional actions to create, merge, assign, and manage cases.
- [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case to investigate related security activity.
- [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation.
- [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign teams and control access to sensitive cases.
- [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Explore playbook examples for case teams and access restrictions.
- [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response.md): Investigate threats and respond using cases, automation, and endpoint actions.
- [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues.md): Cortex Cloud generates issues to bring your attention to security risks in your framework.
- [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): Learn how to review and manage security issues.
- [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-card.md): Understand the information and actions available on an issue card.
- [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/resolution-actions.md): Resolve issues using available resolution actions.
- [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Manage issue associations within a case investigation.
- [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Run an automation to investigate or remediate an issue.
- [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room to coordinate and document an investigation.
- [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): Use a Work Plan to organize investigation tasks and progress.
- [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-syncing.md): Configure issue synchronization with external systems.
- [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-deduplication.md): Understand how Cortex Cloud identifies and deduplicates similar issues.
- [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view.md): Explore the causal relationships behind a security issue.
- [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view.md): Investigate causal relationships for cloud security issues.
- [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud attacks faster with entity context directly in the Cloud causality view.
- [SaaS causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/saas-causality-view.md): Investigate causal relationships for SaaS security issues.
- [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/network-causality-view.md): Investigate causal relationships for network security issues.
- [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/timeline.md): Review the sequence of events that contributed to an issue.
- [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md): Identify icons used in causality views.
- [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions.md): Perform actions that enrich, update, and investigate issues.
- [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issue details for analysis or sharing.
- [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update issue fields to maintain accurate investigation context.
- [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-profile-exceptions.md): Create profile exceptions for trusted or expected activity.
- [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Review events that contributed to an issue.
- [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field.md): Create a featured field to surface important issue details.
- [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md): View the BIOC or IOC rule that generated an issue.
- [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md): Add trusted file paths to a malware profile allow list.
- [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md): Retrieve additional details to support issue investigation.
- [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details for external analysis or record keeping.
- [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from future investigation workflows.
- [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data for investigation and reporting.
- [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status.
- [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings/findings-card.md): Understand the information and actions available on a findings card.
- [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information.
- [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate IP address activity and related security context.
- [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related security activity.
- [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate file and process hashes for malicious activity.
- [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md): Investigate user activity and related security context.
- [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints.md): Investigate endpoints and take response actions when needed.
- [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md): Learn how to initiate and monitor endpoint response actions.
- [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Initiate endpoint actions and monitor their progress.
- [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): Review available Action Center fields, statuses, and actions.
- [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/manage-endpoints.md): View and manage endpoints in your environment.
- [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md): Retrieve files from an endpoint for investigation.
- [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Collect endpoint support logs for troubleshooting.
- [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/scan-an-endpoint-for-malware.md): Run a malware scan on an endpoint.
- [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files.md): Investigate files and manage execution or quarantine actions.
- [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-file-execution.md): Manage file execution decisions during an investigation.
- [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-quarantined-files.md): Review and manage files placed in quarantine.
- [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/review-wildfire-analysis-details.md): Review WildFire analysis results for a file.
- [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/import-file-hash-exceptions.md): Import file hash exceptions into Cortex Cloud.
- [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant.md): Cortex Assistant is designed to streamline processes by simplifying case triaging, investigation, and remediation. It enables you to seamlessly uncover new insights on hashes, hosts, and more. You can
- [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-layout.md): Understand the Cortex Assistant interface and available controls.
- [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md): Explore the tasks Cortex Assistant can help you complete.
- [Automation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation.md): Automate investigation and response workflows in Cortex Cloud.
- [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/quick-actions.md): Run quick actions to automate common investigation tasks.
- [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/automation-exclusion-center.md): Manage exclusions that prevent automation from running.
- [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md): Create and manage policies that exclude automated actions.
- [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks.md): Build and manage playbooks for automated workflows.
- [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbooks-overview.md): Learn how playbooks automate investigation and response processes.
- [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/access-to-playbooks.md): Manage access to playbooks and their content.
- [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbook-development-checklist.md): Follow a checklist when planning and building playbooks.
- [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/plan-your-playbook.md): Plan the purpose, inputs, and flow of your playbook.
- [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/manage-playbooks.md): Create, organize, and maintain playbooks.
- [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md): Build a playbook by configuring tasks, logic, and settings.
- [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Select a template or create a playbook from scratch.
- [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook settings, inputs, and execution behavior.
- [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add reusable tasks from the Task Library to a playbook.
- [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add command and script tasks to a playbook.
- [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse automation workflows.
- [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to automate AI-assisted workflows.
- [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook.
- [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex Cloud.
- [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook.
- [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data.
- [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/create-a-section-header.md): Add section headers to organize playbook tasks.
- [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how a playbook handles script execution errors.
- [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior, data handling, and task flow.
- [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure loops that run a sub-playbook for each item.
- [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data within a playbook.
- [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data.
- [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand filter categories and built-in filters.
- [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand transformer categories and built-in transformers.
- [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Extend playbook context with additional investigation data.
- [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from data during a playbook run.
- [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields using tasks in a playbook.
- [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger.
- [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Diagnose and improve playbook execution performance.
- [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage the tasks, scripts, and settings in a playbook.
- [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md): Use the Agentic Playbook Builder (preview) in Cortex Cloud to create, optimize, and troubleshoot playbooks using natural language and security best practices.
- [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex Cloud security response playbooks for triage, enrichment, and remediation.
- [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/best-practices-for-playbooks.md): Apply recommended practices when designing and maintaining playbooks.
- [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts.md): Create and manage AI prompts for automated workflows.
- [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control.
- [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library.
- [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks.
- [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts.
- [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue.
- [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts.md): Create and manage scripts for automation workflows.
- [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/use-existing-scripts.md): Use existing scripts in playbooks and automation workflows.
- [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/create-a-script.md): Create a custom script for automation workflows.
- [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use Automation Engineer to accelerate script development.
- [Change the Docker image in a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script.md): Configure the Docker image used by a script.
- [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script/connect-an-engine-to-an-image-registry.md): Connect an engine to an image registry for script execution.
- [Context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data.md): Use context data to assist with the investigation and remediation process.
- [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/issue-context-data.md): Understand context data stored for an issue.
- [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/case-context-data.md): Understand context data stored for a case.
- [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/search-context-data.md): Search context data across investigations.
- [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue.
- [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-a-case.md): Add context data to a case.
- [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case.
- [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/use-context-data-in-a-playbook.md): Use context data in playbook tasks.
- [Lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists.md): Create and manage lists for automation workflows.
- [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/create-a-list.md): Create a list for use in automation workflows.
- [List commands](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/list-commands.md): Use commands to manage and query lists.
- [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/use-cases-json-lists.md): Use JSON lists to store structured data.
- [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/transform-a-list-into-an-array.md): Transform a list into an array for automation tasks.
- [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations.md): Configure integrations for automation workflows.
- [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/add-an-integration-instance.md): Add and configure an integration instance.
- [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the CLI.
- [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/troubleshoot-integations.md): Troubleshoot integration configuration and execution issues.
- [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/manage-credentials.md): Manage credentials used by integration instances.
- [Engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines.md): Install, manage, configure, and troubleshoot engines.
- [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/what-is-an-engine.md): Learn how engines execute automation tasks.
- [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines.
- [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine.md): Install, deploy and configure Cortex Cloud engines.
- [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex Cloud engines.
- [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions.
- [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers.
- [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers.
- [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-faqs.md)
- [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md)
- [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md)
- [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md)
- [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide.md)
- [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md)
- [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md)
- [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md)
- [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md)
- [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md)
- [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md)
- [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md)
- [Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex Cloud engines.
- [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine.
- [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex Cloud engines.
- [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman.
- [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex Cloud engines.
- [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/manage-engines.md): Manage engines and load balancing groups.
- [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex Cloud or directly on the remote machine.
- [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system.
- [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines.md): Configure Cortex Cloud engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations).
- [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md)
- [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md)
- [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md)
- [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md)
- [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration.
- [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance.
- [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors.
- [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-integrations-running-on-engines.md)
- [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions.md): During the case investigation, various response actions are available.
- [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/initiate-a-live-terminal-session.md): Start a Live Terminal session on an endpoint.
- [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/isolate-an-endpoint.md): Isolate an endpoint from the network.
- [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/pause-endpoint-protection.md): Pause endpoint protection when investigation requires it.
- [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/remediate-changes-from-malicious-activity.md): Remediate changes caused by malicious activity.
- [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/search-and-destroy-malicious-files.md): Search for and remove malicious files from endpoints.
- [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/manage-external-dynamic-lists.md): Manage external dynamic lists used for enforcement.
- [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/collect-a-memory-image.md): Collect a memory image from an endpoint.
- [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics.md): Conduct forensic investigations and collect evidence from endpoints.
- [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations.md): Conduct forensic investigations across endpoints.
- [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation.md): Create, manage, and review forensic investigations.
- [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Create a forensic investigation, assign access, and start a data collection.
- [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Update an active investigation's details and user access.
- [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an investigation and manage its 24-hour grace period.
- [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation.
- [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection.md): Collect endpoint data for forensic investigation.
- [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/hunting.md): Collect data to support threat hunting.
- [Triage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/triage.md): Collect data for endpoint triage.
- [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/configure-collection.md): Configure forensic data collection settings.
- [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation.md): Analyze forensic results and document investigation findings.
- [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/review-alerts.md): Review alerts generated during a forensic investigation.
- [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md): Review the timeline of forensic investigation activity.
- [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md): Review key assets and artifacts in an investigation.
- [Export](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/export.md): Export forensic investigation data and results.
- [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder.
- [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats.
- [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder.
- [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started creating and running XQL queries.
- [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use XQL editor features to build queries efficiently.
- [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply best practices when writing XQL queries.
- [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected results when querying fields with XQL.
- [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query to analyze your data.
- [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and interpret XQL query results.
- [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate queries into XQL syntax.
- [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results in a graph.
- [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder.
- [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create XQL queries for authentication data.
- [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create XQL queries for event log data.
- [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query.md): Create XQL queries for file data.
- [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create XQL queries for image load data.
- [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create XQL queries for network connection data.
- [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query.md): Create XQL queries for network data.
- [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query.md): Create XQL queries for process data.
- [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query.md): Create XQL queries for registry data.
- [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query data across all entity types.
- [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant.
- [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run queries in Query Center.
- [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Review Query Center fields and capabilities.
- [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries.
- [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Review Scheduled Queries fields and capabilities.
- [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): Cortex Cloud provides as part of the Query Library a personal library for saving and managing your own queries.
- [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic.
- [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md): Create, edit, and manage your XQL macros.
- [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions.
- [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/research-a-known-threat.md): Cortex Cloud enables you to investigate any threat, also referred to as a lead, which has been detected.
- [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues.md): Customize your cases and issues for specific requirements.
- [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/set-up-case-scoring.md): Configure how Cortex Cloud calculates case scores.
- [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-starring-configuration.md): Create configurations that highlight important cases and issues.
- [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals.
- [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create case timers and service-level agreements.
- [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Update fields used by case timers and service-level agreements.
- [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays.
- [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules.
- [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues.
- [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create an exception rule from an issue.
- [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View exception rules configured for issues.
- [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable issue exception rules when they are no longer needed.
- [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View issues excluded by exception rules.
- [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/optimize-case-grouping-in-correlations.md): Optimize case grouping for correlation-based detections.
- [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-sync-profile.md): Create a sync profile for cases and issues.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.