> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/cloud-causality-view.md).
# Cloud causality view
{% hint style="info" %}
### Notice
Requires a Cortex XDR Pro license.
{% endhint %}
The cloud causality view provides a powerful way to analyze and respond to Cortex XDR alerts and cloud audit logs. The scope of the cloud causality view is the Causality Instance (CI) of an event to which this alert pertains. The cloud causality view presents the event identity and /or IP address and the actions performed by the identity on the cloud resource. On each node in the CI chain, Cortex XDR provides information to help you understand what happened around the event.
The cloud causality view comprises the following sections:
Information Overview
Summarizes information about the alert you are analyzing, including the type of Cloud Provider, Project, and Region on which the event occurred. Select **View Raw Log** to view the raw log as provided by the Cloud Provider in JSON format.
Causality instance chain
Includes the graphical representation of the Causality Instance (CI) along with other information and capabilities to enable you to conduct your analysis.
The view presents a single event CI chain. The CI chain is built from Identity and Resource nodes. The Identity node represents for example keys, service accounts, and users, while the Resource node represents for example network interfaces, storage buckets, or disks. When available, the chain might also include an IP address and alerts that were triggered on the Identity and Cloud Resource.
The causality view provides an interactive way to view the CI chain for an alert. You can extend the CI chain, modify it, and move the chain around by selecting and dragging it. You can also enlarge or shrink the chain by using the size controls. To return the chain to its original position and size, click  in the lower-right of the CI graph.
Causality data is displayed as follows:
* **Identity node:** Displays the name of the identity, generated alert information, and if available the associated IP address.
To further investigate the user:
1. Hover over an Identity node to display, if available, the identity **Analytics Profiles**.
2. Select the Identity node to display in the Entity Data section additional information about the Identity entity.
3. Select the Alert icon to display in the Entity Data section additional information about the alert.
* **IP address node:** Displays the IP address associated with the Identity.
* **Operations:** Lists the type of operations performed by the identity on the cloud resources. Hover over the operation to display the original operation name as provided by the cloud Provider.
* **Cloud resource node:** Displays the referenced resource on which the operation was performed. Cortex XDR displays information on the following resources:
| Icon | Type of Resource |
| --------------------------------------------------------------------- | ------------------------------------ |
|  | Compute instance resource |
|  | Disk resource |
|  | General resource |
|  | Image resource |
|  | Network interface resource |
|  | Security group (FW rule) resource |
|  | Storage bucket resource |
|  | Virtual private cloud (VPC) resource |
To further investigate the resource:
1. Hover over a resource node to display, if available, the resource **Analytics Profiles** and **Resource Editors** statistics.
2. Select the resource node to display in the Entity Data section additional information about the resource entity.
All Events table
Displays up to 100,000 related events and up to 1,000 related alerts. In the **All Events** table, Cortex XDR displays detailed information about each of the related events. To simplify your investigation, Cortex XDR scans your Cortex XDR data aggregating the events that have the same Identity or Resource and displays the entry with an  aggregated icon. Right-click and select **Show Grouped Events** to view the aggregated entries.
Entries highlighted in red indicate that the specific event triggered an alert. To continue the investigation, right-click to **View in XQL**.
To continue the investigation, in the **Alerts** table, right-click an alert to see the available actions.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/cloud-causality-view.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.