> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/what-are-incidents.md). # What are incidents? An incident represents a single, self-contained attack. An incident is a container object to group related alerts, assets, and artifacts, that originate from a single root cause. The root cause might be a self-contained cyberattack that brings multiple actors together to attack (such as attackers, tools, and processes), or it might be a combination of malware and exploits. Incidents comprise the following objects: * **Alerts:** Notification objects to report suspicious activity or events * **Assets:** Names of affected endpoints and users * **Artifacts:** Attributes of attacking objects such as filenames, file signers, processes, domains, and IP addresses Each incident is individually configured and requires its own independent investigation. To see a list of all Incidents, navigate to the **Incidents** page. **Incident thresholds** To keep incidents fresh and relevant, Cortex XDR implements the following thresholds. When the incident reaches a threshold, it stops accepting alerts and groups subsequent related alerts in a new incident. * 30 days after incident creation * 14 days since the last alert in the incident was detected (excludes backward scan alerts). * An incident reaches the 1,000 alert limit. You can track the threshold status in the `Alerts Grouping Status` field in the Incidents table. **Additional incident information** An incident can contain one or more related alerts. Alerts are linked to incidents by matching their content. If a new alert is triggered in the system that doesn't match any of the existing incidents, a new incident is created. When an alert is linked to an incident, all associated assets and artifacts are also linked to the incident. Each incident is individually configured and requires its own independent investigation. Only medium, high, or critical alerts lead to the creation of a new incident. In general, informational alerts are included in incidents as Insights, however, some analytics detectors have exceptions that create incidents for low severity alerts. Low severity issues created from correlation rules are not grouped into incidents. If an incident is resolved with the status `Resolved - Auto Resolved`, Cortex XDR can reopen the incident for up-to six hours if a new alert is triggered that matches the incident. The six-hour period is defined by the timestamp of the last alert that was grouped into the incident. After the six-hour period, any new alerts are linked to a new incident for a new investigation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/what-are-incidents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.