> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues.md).
# About health issues
{% hint style="info" %}
For Cortex Cloud to monitor data ingestion health and create health issues, you must enable the following settings under Configurations:
Cortex - Analytics: Go to Configurations → Cortex - Analytics. For more information, see [Enable the Analytics Engine and Identity Analytics](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/deployment-steps/cortex-xsiam-analytics/enable-the-analytics-engine-and-identity-analytics).
{% endhint %}
Cortex Cloud provides health issues to help you monitor the health and integrity of supported Cortex Cloud resources. Health issues provide insights into health drifts, such as failure events or status changes. The issues help you stay on top of your health related errors and ensure optimal performance in Cortex Cloud. In addition, you can set up notifications on health issues.
Health issues are associated with the Health Domain. When setting up notification forwarding or other configurations for health issues, use the filter Issue Domain = Health.
To view health issues, go to Settings → Health Issues, or on the Issues page select the Health Domain table view. Click an issue to see more details in the issue card, or right-click to take actions and investigate an issue. For more information, see [Investigate and resolve health issues](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues).
The Health Issues page displays issues that were triggered after July 2024. To see health issues that were triggered before this date, click Legacy Health Issues.
**Types of health issues**
Cortex Cloud provides the following types of OOTB health issues:
* **Ingestion issues**: Triggered by interruptions in data ingestion, or deviation from the calculated ingestion baseline
* **Collection issues**: Triggered by connectivity errors in your collection integrations, custom collectors, and Marketplace integrations
* **Correlation issues**: Triggered by correlation rules that complete with an error status
* **Automation issues**: Triggered by system monitoring of metrics and thresholds for potential automation misconfigurations that can cause performance issues. Automation issues are processed daily to provide an aggregated status of multiple threshold crossings.
Cortex Cloud enforces the dedup logic to health issues. This logic reduces the likelihood of identical health issues from flooding the issues dataset.
**Query health issue data**
Health issues are associated with the Health domain. To query health issue data, use the following XQL:
```
dataset = alerts | filter alert_domain = "DOMAIN_HEALTH"
```
**Health issue field descriptions**
The following table describes the health issue fields.
| Field | Description |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Issue ID | A unique identifier that Cortex Cloud assigns to each issue. |
| Issue Name | Name of the issue. |
| Issue Type | Type of health issue. |
| Issue Source | Source of the issue. |
| Broker VM ID | ID of the Broker VM. |
| Broker VM Name | Host name of the Broker VM. |
| Broker VM IP | IP address of the Broker VM. |
| Collector Name | Name of the collector instance. |
| Collector Type | Type of the collector. |
| Description | Text summary of the event including the issue source, issue name, and severity. |
| Device ID | Firewall device ID. |
| Excluded | Whether the issue is excluded. |
| External ID | Issue ID as recorded in the detector from which this issue was sent. |
| Final Reporting Device IP | IP of the device from which the log was extracted. |
| Final Reporting Device Name | Hostname of the device from which the log was extracted. |
| Ingestion Failure Duration | Amount of time that logs were not received or a drop in log ingestion was detected in minutes. |
| Observation Time | Time that the issue was observed in the system. |
| Playbook | Playbook that was run. |
| Playbook run status | Status of the playbook. |
| Product | Product name of the observing data source. |
| Resolution Status | Status that was assigned to this issue when it was triggered (or modified). Right-click an issue to change the status. If you set the status to Resolved, select a resolution reason. |
| Reporting Device Name | Host name of the device where the log originated. |
| Reporting Device IP | IP Address of the device where the log originated. |
| Severity | Severity level that was assigned to this issue when it was triggered (or modified). |
| Starred | Whether the issue is starred by starring configuration. |
| Vendor | Vendor of the observing data source. |
| XDR Collector ID | ID of the XDR Collector. |
| XDR Collector IP | IP address of the XDR Collector. |
| XDR Collector Name | Host name of the XDR Collector. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.