> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/alert-side-panel.md). # Alert side panel The alert side panel provides detailed information about alerts at a glance and in the context of the incident. To open the alerts panel, on the **Alerts** page click on any alert. In this view, you can change the severity of an alert, star it, investigate it in the causality view, and exclude it from the Analytics. The panel displays the name and description of the alert, the source that triggered the alert, and the following details where applicable: * **General:** Displays general information about the alert. * **Number of suppressed alerts:** (for IOC, BIOC, and Analytics alerts) Number of alerts that were suppressed because they were detected as duplicates of the alert * **Last suppressed alert timestamp:** (for IOC, BIOC, and Analytics alerts) The last time Cortex XDR suppressed an alert because it was detected as a duplicate of the alert * **Action:** Taken as a result of the alert * **Category:** Type of threat detected * **File Macro SHA256** * **Tags:** As applied by Cortex XDR * **Behavioral analytics:** Displays graphs that visualize the anomalies that were observed by the detector.

Note

The Behavioral Analytics section is available only when the Identity Threat Module add-on is enabled. Cortex XDR displays Behavioral Analytics widgets for selected alerts and is continuously adding widgets to more alerts.

You can use this section to evaluate the deviation in the context of the baseline behavior. As you navigate between the different factors that triggered the alert, the event and the baseline information are displayed in tabular format or in timeline format, depending on the type of event. * The tabular view displays the baseline behavior in a table, with the anomaly highlighted and in a separate line. * The timeline view displays the highlighted atypical value, and if applicable, the minimum, maximum, and average values, for the selected period. * **MITRE ATT\&CK:** Displays the MITRE ATT\&CK tactics and techniques. * **Host:** Displays the Host platform, Host name, Host IP, Host MAC address, Host FQDN. * **Rule:** Displays details about the alert that triggered the rule. * **Connection details:** Displays information about network connections, login, process execution, RPC calls, system calls, or registry events. * **Cloud audit log**: Displays the audit log details for alerts generated on cloud hosts. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/alert-side-panel.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.