> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues.md).

# Cases and issues

- [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases.md)
- [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/what-are-cases.md)
- [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/resolving-cases-with-ai.md)
- [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-lifecycle.md)
- [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-thresholds.md)
- [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-scope-and-impact.md)
- [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-and-issue-domains.md)
- [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/overview-of-case-teams-and-roles.md)
- [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts.md)
- [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/issues-findings-and-events.md)
- [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-grouping.md)
- [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-scoring.md)
- [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/what-is-causality.md)
- [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases.
- [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/review-all-cases.md)
- [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis.md)
- [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md)
- [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context.md)
- [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md)
- [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md)
- [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md)
- [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md)
- [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md)
- [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/evidence.md)
- [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/issue-feed.md)
- [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md)
- [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md)
- [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md)
- [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/case-timeline.md)
- [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/detailed-view.md)
- [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case.md)
- [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-center.md)
- [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md)
- [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md)
- [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md)
- [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md)
- [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions.md)
- [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/create-a-case.md)
- [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md)
- [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md)
- [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md)
- [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response.md)
- [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues.md): Cortex Cloud generates issues to bring your attention to security risks in your framework.
- [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md)
- [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-card.md)
- [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/resolution-actions.md)
- [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md)
- [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md)
- [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md)
- [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md)
- [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-syncing.md)
- [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-deduplication.md)
- [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view.md)
- [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view.md)
- [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud attacks faster with entity context directly in the Cloud causality view.
- [SaaS causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/saas-causality-view.md)
- [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/network-causality-view.md)
- [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/timeline.md)
- [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md)
- [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions.md)
- [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md)
- [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md)
- [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-profile-exceptions.md)
- [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md)
- [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field.md)
- [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md)
- [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md)
- [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md)
- [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md)
- [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md)
- [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md)
- [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status.
- [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings/findings-card.md)
- [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information.
- [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md)
- [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md)
- [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md)
- [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md)
- [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints.md)
- [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md)
- [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md)
- [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md)
- [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/manage-endpoints.md)
- [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md)
- [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md)
- [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/scan-an-endpoint-for-malware.md)
- [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files.md)
- [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-file-execution.md)
- [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-quarantined-files.md)
- [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/review-wildfire-analysis-details.md)
- [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/import-file-hash-exceptions.md)
- [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant.md): Cortex Assistant is designed to streamline processes by simplifying case triaging, investigation, and remediation. It enables you to seamlessly uncover new insights on hashes, hosts, and more. You can
- [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-layout.md)
- [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md)
- [Automation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation.md)
- [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/quick-actions.md)
- [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/automation-exclusion-center.md)
- [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md)
- [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks.md)
- [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbooks-overview.md)
- [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/access-to-playbooks.md)
- [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbook-development-checklist.md)
- [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/plan-your-playbook.md)
- [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/manage-playbooks.md)
- [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md)
- [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md)
- [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md)
- [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md)
- [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md)
- [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md)
- [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md)
- [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook.
- [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex Cloud.
- [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook.
- [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data.
- [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/create-a-section-header.md)
- [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md)
- [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md)
- [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md)
- [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md)
- [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md)
- [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md)
- [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md)
- [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md)
- [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md)
- [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md)
- [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger.
- [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md)
- [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md)
- [Accelerate playbook development using the Automation Engineer agent (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview.md)
- [Automation Engineer prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview/automation-engineer-prompt-examples.md)
- [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/best-practices-for-playbooks.md)
- [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts.md)
- [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control.
- [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library.
- [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks.
- [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts.
- [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue.
- [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts.md)
- [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/use-existing-scripts.md)
- [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/create-a-script.md)
- [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md)
- [Change the Docker image in a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script.md)
- [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script/connect-an-engine-to-an-image-registry.md)
- [Context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data.md): Use context data to assist with the investigation and remediation process.
- [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/issue-context-data.md)
- [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/case-context-data.md)
- [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/search-context-data.md)
- [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-an-issue.md)
- [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-a-case.md)
- [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/delete-context-data-from-a-case.md)
- [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/use-context-data-in-a-playbook.md)
- [Lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists.md)
- [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/create-a-list.md)
- [List commands](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/list-commands.md)
- [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/use-cases-json-lists.md)
- [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/transform-a-list-into-an-array.md)
- [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations.md)
- [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/add-an-integration-instance.md)
- [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/use-integration-commands-in-the-cli.md)
- [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/troubleshoot-integations.md)
- [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/manage-credentials.md)
- [Engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines.md): Install, manage, configure, and troubleshoot engines.
- [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/what-is-an-engine.md)
- [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines.
- [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine.md): Install, deploy and configure Cortex Cloud engines.
- [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex Cloud engines.
- [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions.
- [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers.
- [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers.
- [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-faqs.md)
- [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md)
- [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md)
- [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md)
- [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide.md)
- [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md)
- [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md)
- [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md)
- [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md)
- [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md)
- [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md)
- [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md)
- [Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex Cloud engines.
- [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine.
- [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex Cloud engines.
- [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman.
- [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex Cloud engines.
- [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/manage-engines.md): Manage engines and load balancing groups.
- [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex Cloud or directly on the remote machine.
- [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system.
- [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines.md): Configure Cortex Cloud engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations).
- [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md)
- [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md)
- [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md)
- [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md)
- [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration.
- [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance.
- [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors.
- [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-integrations-running-on-engines.md)
- [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions.md): During the case investigation, various response actions are available.
- [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/initiate-a-live-terminal-session.md)
- [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/isolate-an-endpoint.md)
- [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/pause-endpoint-protection.md)
- [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/remediate-changes-from-malicious-activity.md)
- [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/search-and-destroy-malicious-files.md)
- [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/manage-external-dynamic-lists.md)
- [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/collect-a-memory-image.md)
- [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics.md)
- [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations.md)
- [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation.md)
- [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Create a forensic investigation, assign access, and start a data collection.
- [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Update an active investigation's details and user access.
- [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an investigation and manage its 24-hour grace period.
- [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation.
- [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection.md)
- [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/hunting.md)
- [Triage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/triage.md)
- [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/configure-collection.md)
- [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation.md)
- [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/review-alerts.md)
- [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md)
- [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md)
- [Export](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/export.md)
- [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder.
- [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats.
- [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder.
- [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md)
- [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md)
- [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md)
- [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md)
- [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md)
- [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md)
- [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md)
- [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md)
- [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder.
- [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query.md)
- [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query.md)
- [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query.md)
- [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query.md)
- [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query.md)
- [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query.md)
- [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query.md)
- [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query.md)
- [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md)
- [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant.
- [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md)
- [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md)
- [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries.
- [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md)
- [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): Cortex Cloud provides as part of the Query Library a personal library for saving and managing your own queries.
- [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/xql-macros.md)
- [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md)
- [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions.
- [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/research-a-known-threat.md): Cortex Cloud enables you to investigate any threat, also referred to as a lead, which has been detected.
- [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues.md): Customize your cases and issues for specific requirements.
- [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/set-up-case-scoring.md)
- [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-starring-configuration.md)
- [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals.
- [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md)
- [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md)
- [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays.
- [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules.
- [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues.
- [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md)
- [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md)
- [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md)
- [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md)
- [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/optimize-case-grouping-in-correlations.md)
- [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-sync-profile.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.