> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-grouping.md). # Case grouping Learn how Cortex Cloud groups related issues into cases. Case grouping is a Precision AI™-powered capability that eliminates alert fatigue by automatically consolidating related issues and artifacts into a single unified case. Case grouping links issues that originate from the same attack flow or involve the same entity to reveal the full scope of a case. This approach replaces manual correlation with automated context, allowing you to focus on resolving complete problems rather than triaging isolated events. ### **Grouping methodologies** The key grouping methodologies of case grouping are: * **Artifact association:** Groups issues that share core artifacts (for example, SHA256, HostName, UserName). * **Exact match detection:** Groups similar detections for the same entities. * **Related entities:** Groups detections involving related assets within a close timeframe to highlight possible connections. ### **Case grouping qualification** When a new issue is triggered, it is evaluated to determine if it meets the criteria for case promotion. If the issue qualifies, the system uses case grouping logic to correlate the issue with an existing case; if no match is found, a new case is generated. {% hint style="info" %} The Case grouping logic is dynamic and may be updated to reflect ongoing research and threat relevance. {% endhint %} Issues with the following conditions automatically qualify for case grouping: * Assigned to the **Security** domain with **Medium** severity or higher. * Assigned to the **Posture** domain with **Medium** severity or higher. While case grouping is active, Cortex XSIAM can continue to link new issues to a case, however, to keep cases manageable, specific grouping thresholds are enforced. For more information see [Case thresholds](/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-thresholds.md). In cases with multiple linked issues, you can see the connection between the issues and the case grouping status (active/inactive) in the [Grouping Graph](/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md). ### **Grouping artifacts** The grouping algorithm evaluates extracted artifacts to determine whether an issue should join an existing case or initiate a new one. Each artifact type is governed by specific logic that accounts for its unique lifecycle and reliability. For example, grouping by Username may be subject to temporal constraints, while IP address logic varies based on whether the address is public, private, or dynamically allocated (DHCP). These proprietary grouping logics are continuously tuned and updated. As a result, artifact behavior and correlation may change over time. If you set up custom detections with correlation rules that trigger issues, you can influence the grouping of the triggered issues by mapping specific fields in your configuration. For more information, see [Optimize case grouping in correlations](/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/optimize-case-grouping-in-correlations.md). ### **Integration with SmartScore** Case grouping and SmartScore work together to improve triage efficiency. While case grouping provides the full context of an attack, **SmartScore** assigns a numerical value to that context, indicating the urgency and impact of the case. This allows you to prioritize the most critical cases first. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-grouping.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.