> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats.md).

# Detect, investigate, and respond to threats

- [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports.md): Monitor security data with Cortex XDR dashboards and reports.
- [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn about Cortex XDR dashboards, reports, widgets, and their workflows.
- [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Explore the controls and layout of the Cortex XDR dashboard interface.
- [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Compare available dashboard types and their intended uses.
- [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports organize and deliver dashboard data.
- [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Browse available widgets for dashboards and reports.
- [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Control access, visibility, and sharing for dashboards and reports.
- [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure who can view dashboards and reports.
- [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Manage user access to dashboard widgets.
- [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand dashboard and report sharing status icons.
- [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Reference dashboard and report access and sharing permissions.
- [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboard and report ownership, sharing, imports, and deleted content.
- [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to organize and maintain dashboards.
- [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): Manage and generate reports from Cortex XDR data.
- [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Create copies of existing dashboards and report templates.
- [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates with other users.
- [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Transfer ownership of dashboards and report templates.
- [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates.
- [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Get notified when a scheduled report fails.
- [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboards and reports.
- [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards.md): Create dashboards that monitor the data most important to your team.
- [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Build a dashboard with the widgets and filters you need.
- [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports.md): Create reports that summarize Cortex XDR data.
- [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Build a report template from an empty layout.
- [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration.md): Configure custom widgets, global filters, and drilldowns.
- [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets for dashboards and reports.
- [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Use AI to create custom dashboard widgets.
- [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Build custom widgets with XQL queries.
- [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add reusable parameters to custom XQL widgets.
- [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create dashboard widgets that run scripts.
- [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Apply filters across dashboard widgets and reports.
- [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure drilldowns from dashboard widgets to detailed data.
- [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference.md): Reference system dashboards and Command Center dashboards.
- [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference dashboards available in Command Center.
- [Cloud Detection and Response (CDR) Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cloud-detection-and-response-cdr-command-center.md): Explore the Cloud Detection and Response Command Center dashboard.
- [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Explore the Cortex Cloud Command Center dashboard.
- [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference dashboards provided with Cortex XDR.
- [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations with system dashboards.
- [Data Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/data-ingestion.md): Use Cortex XDR Data Ingestion to monitor data collection health, volume, and coverage.
- [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management.md): Discover, organize, and manage assets across your Cortex XDR environment.
- [Asset inventory overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-inventory-overview.md): Learn about the core concepts, features, and lifecycle of assets within the Asset Inventory.
- [All assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-assets.md): Learn about the All Assets page, under Asset Inventory.
- [All cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets.md): Learn about the All Cloud Assets page to view and assess your cloud footprint.
- [Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/discovery-engine.md): Learn how Discovery Engine identifies assets in your environment.
- [Asset hierarchy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/asset-hierarchy.md): Understand how Cortex XDR organizes related assets.
- [Asset classes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes.md): Accelerating remediation: Automated fix suggestions and manual remediation guidance enable developers to resolve code weaknesses directly in the source repository without context-switching to external
- [AI assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/ai-assets.md): View and manage AI assets in your environment.
- [API assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/api-assets.md): View and manage discovered API assets.
- [Application assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/application-assets.md): View and manage application assets.
- [Code and Supply Chain Security assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets.md): View code and supply chain security assets.
- [Compute assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets.md): View and manage compute assets.
- [Container image assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets.md): View and manage container image assets.
- [Serverless functions assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/serverless-functions-assets.md): View and manage serverless function assets.
- [VM images assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/vm-images-assets.md): View and manage virtual machine image assets.
- [Data assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/data-assets.md): View and manage data assets.
- [Device assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/device-assets.md): View and manage device assets.
- [External Surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets.md): View assets discovered across your external attack surface.
- [Identity assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/identity-assets.md): View and manage identity assets.
- [Network assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/network-assets.md): View and manage network assets.
- [Security services assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/security-services-assets.md): View and manage security service assets.
- [Asset groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md): Group assets based on shared attributes to address them collectively, simplify filtering, and enable strict access control boundaries.
- [Manage Risk Scores](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores.md): View and investigate User Scores and Host Scores using the Risk Scores page to identify high-risk assets and detect compromised accounts or malicious activities.
- [Asset configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations.md): Configure criteria and roles used to manage assets.
- [Network configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/network-configuration.md): Configure your internal network parameters, trusted networks, and external IP ranges to help Cortex XDR identify and map your network assets.
- [Application criteria](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/application-criteria.md): Define criteria used to identify application assets.
- [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles.md): View asset roles and the number of assets that are associated with each role. Learn how to manage asset roles for users and endpoints.
- [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-endpoints.md): Assign and manage roles for endpoint assets.
- [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users.md): Assign and manage roles for user assets.
- [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user.md): Configure honey users to detect suspicious identity activity.
- [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/vulnerability-assessment.md): Perform a vulnerability assessment of all endpoints in your network using Cortex XDR. This includes CVE, endpoint, and application analysis.
- [Investigate and respond to cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases.md): Investigate, contain, and resolve cases and issues.
- [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases.md): Understand how cases work in Cortex XDR.
- [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/what-are-cases.md): Learn how Cortex XDR groups related security activity into cases.
- [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/resolving-cases-with-ai.md): Use AI capabilities to help resolve security cases.
- [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-lifecycle.md): Understand each stage of a case from creation through resolution.
- [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-thresholds.md): Learn how thresholds determine case creation and updates.
- [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-scope-and-impact.md): Understand how Cortex XDR calculates case scope and impact.
- [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-and-issue-domains.md): Understand the domains associated with cases and issues.
- [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/overview-of-case-teams-and-roles.md): Learn how case teams and roles control case access.
- [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts.md): Learn the concepts that shape case analysis and resolution.
- [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/issues-findings-and-events.md): Understand the relationships among issues, findings, and events.
- [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-grouping.md): Learn how Cortex XDR groups related activity into cases.
- [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-scoring.md): Learn how Cortex XDR calculates case scores.
- [Case starring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-starring.md): Star cases to prioritize them for investigation.
- [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/what-is-causality.md): Learn how Causality connects related events and alerts.
- [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases.
- [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/review-all-cases.md): Monitor and prioritize cases across your environment.
- [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/start-case-analysis.md): Open a case and begin an investigation.
- [Establish Case context](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context.md): Establish the case context before deeper analysis.
- [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Review AI-generated summaries of case activity and context.
- [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Assess and update a case severity and score.
- [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update the attributes associated with a case.
- [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details.md): Investigate case evidence, relationships, and activity.
- [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to examine related case activity.
- [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence that supports case investigation.
- [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Review issues associated with a case.
- [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case.
- [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review mapped MITRE ATT\&CK tactics and techniques.
- [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls linked to a case.
- [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review a chronological timeline of case activity.
- [Detailed View](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Review detailed information about a case.
- [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case.md): Remediate findings and close the case.
- [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to complete case resolution tasks.
- [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments while resolving a case.
- [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Resolve a case and document its outcome.
- [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for cases and issues.
- [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Monitor and track case and issue resolution times.
- [Use Cortex Agentic Assistant chat in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/use-cortex-agentic-assistant-chat-in-an-investigation.md): Use Agentic Assistant chat during an investigation.
- [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions.md): Create, merge, assign, and manage cases.
- [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case to track a security investigation.
- [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation.
- [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign a team and restrict access to sensitive cases.
- [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Review playbook examples for case teams and access controls.
- [Unified case view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/unified-case-view.md): Use the unified case view to investigate related activity.
- [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues.md): Cortex XDR generates issues to bring your attention to security risks in your framework.
- [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/overview-of-the-issues-page.md): Learn how to review and manage issues.
- [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-card.md): Understand the information shown on an issue card.
- [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/resolution-actions.md): Apply resolution actions to issues.
- [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/link-or-unlink-issues-from-a-case.md): Link issues to cases or remove existing links.
- [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/run-an-automation-on-an-issue.md): Run an automation directly from an issue.
- [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/use-the-war-room-in-an-investigation.md): Use War Room to investigate, collaborate, and run response actions.
- [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/use-the-work-plan-in-an-investigation.md): Use Work Plan to monitor and manage issue playbook tasks.
- [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-deduplication.md): Learn how Cortex XDR deduplicates related issues.
- [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view.md): Investigate issue activity through the Causality view.
- [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/network-causality-view.md): Investigate network activity in the Causality view.
- [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/cloud-causality-view.md): Investigate cloud activity in the Causality view.
- [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud attacks faster with entity context directly in the Cloud causality view.
- [Saas causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/saas-causality-view.md): Investigate SaaS activity in the Causality view.
- [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/timeline.md): Review a timeline of related issue activity.
- [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/causality-icons-key.md): Reference icons used in the Causality view.
- [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions.md): Use actions that support issue investigation and resolution.
- [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issues for separate investigation or recordkeeping.
- [Analyze an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/analyze-an-issue.md): Analyze issue details and related security activity.
- [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/create-profile-exceptions.md): Create profile exceptions from an issue.
- [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md): Retrieve additional details for an issue investigation.
- [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md): Add file paths to the malware profile allow list.
- [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Investigate events that contributed to an issue.
- [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/create-a-featured-field.md): Create a featured field for issue analysis.
- [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md): View the BIOC or IOC rule that generated an issue.
- [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file for sharing or recordkeeping.
- [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from further detection processing.
- [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query data associated with cases and issues.
- [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update fields associated with an issue.
- [Close an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/close-an-issue.md): Close an issue after completing its investigation.
- [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status.
- [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/review-findings/findings-card.md): Understand the information displayed on a findings card.
- [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information.
- [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate an IP address from an issue or elsewhere in Cortex XDR.
- [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related activity.
- [Investigate a host](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-host.md): Investigate host details, activity, and related security events.
- [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate a file or process hash and its related activity.
- [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-user.md): Investigate a user and their related security activity.
- [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints.md): You can investigate and take actions on your endpoints in the Action Center.
- [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center.md): Use the Action Center to monitor and manage response actions.
- [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Initiate and monitor response actions on endpoints.
- [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): Reference Action Center statuses, fields, and available actions.
- [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/manage-endpoints.md): Manage endpoints during security investigations.
- [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-files-from-an-endpoint.md): Retrieve a file from an endpoint for investigation.
- [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Retrieve endpoint support logs for troubleshooting and analysis.
- [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-support-file-password.md): Retrieve the password for an endpoint support file.
- [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/scan-an-endpoint-for-malware.md): Scan an endpoint for malware and review the results.
- [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files.md): Investigate files and manage file-related response actions.
- [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/manage-file-execution.md): Manage file execution during an investigation.
- [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/manage-quarantined-files.md): Review and manage quarantined files.
- [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/review-wildfire-analysis-details.md): Review WildFire analysis details for a submitted file.
- [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/import-file-hash-exceptions.md): Import file hash exceptions for endpoint protection.
- [Automation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation.md): Automate investigation and response workflows in Cortex XDR.
- [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/quick-actions.md): Run common automation actions during an investigation.
- [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/automation-exclusion-center.md): Review automation exclusions that protect critical assets.
- [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/manage-automation-exclusion-policies.md): Create and manage automation exclusion policies.
- [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks.md): Build and manage playbooks for automated response workflows.
- [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/playbooks-overview.md): Learn how playbooks automate security investigation and response.
- [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/access-to-playbooks.md): Configure access permissions for playbooks.
- [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/playbook-development-checklist.md): Use a checklist to plan and validate playbook development.
- [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/plan-your-playbook.md): Plan the logic, inputs, and outcomes for a playbook.
- [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/manage-playbooks.md): Manage existing playbooks and their versions.
- [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook.md): Build a playbook that automates your investigation workflow.
- [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Choose an existing playbook or create one for your response workflow.
- [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook settings, triggers, and inputs.
- [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add tasks and objects from the Task Library.
- [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts to playbook tasks.
- [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse automation steps within a playbook.
- [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to a playbook.
- [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook.
- [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex XDR.
- [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook.
- [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data.
- [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/create-a-section-header.md): Organize playbook tasks with section headers.
- [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how a playbook handles errors from script tasks.
- [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior, data, and task flow.
- [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure loops that run a sub-playbook for each input item.
- [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in playbook tasks.
- [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data.
- [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Learn about filters and select the right built-in option.
- [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Learn about transformers and select the right built-in option.
- [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Add task output to the investigation context.
- [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from playbook task output.
- [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields with playbook task output.
- [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger.
- [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Diagnose and improve playbook performance.
- [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage tasks, inputs, outputs, and content in playbooks.
- [Accelerate playbook development using the Automation Engineer agent (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview.md): Use the Automation Engineer agent to accelerate playbook development.
- [Automation Engineer prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-automation-engineer-agent-preview/automation-engineer-prompt-examples.md): Use prompt examples with Automation Engineer.
- [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/best-practices-for-playbooks.md): Follow recommended practices for creating and maintaining playbooks.
- [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts.md): Create and manage AI prompts for automation workflows.
- [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control.
- [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library.
- [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks.
- [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts.
- [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue.
- [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts.md): Create and manage scripts for automated workflows.
- [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/use-existing-scripts.md): Find and use existing scripts in automation workflows.
- [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/create-a-script.md): Create a script for use in automation workflows.
- [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Automation Engineer agent to accelerate script development.
- [Change the Docker image in a script](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/change-the-docker-image-in-a-script.md): Change the Docker image used when a script runs.
- [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/change-the-docker-image-in-a-script/connect-an-engine-to-an-image-registry.md): Connect an engine to an image registry for script dependencies.
- [Context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data.md): Use context data to assist with the investigation and remediation process.
- [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/issue-context-data.md): View and manage context data stored for an issue.
- [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/case-context-data.md): View and manage context data stored for a case.
- [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/search-context-data.md): Search context data to support issue investigation and automation.
- [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue for investigation and automation.
- [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/add-context-data-to-a-case.md): Add context data to a case for investigation and automation.
- [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case when it is no longer needed.
- [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/use-context-data-in-a-playbook.md): Use context data as inputs and outputs in playbooks.
- [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists.md): Create and manage lists for use in playbooks and scripts.
- [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/create-a-list.md): Create a list for playbooks, scripts, and automation.
- [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/list-commands.md): Use list commands to retrieve and update list data.
- [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/use-cases-json-lists.md): Use JSON lists to store and process structured automation data.
- [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/transform-a-list-into-an-array.md): Convert a list into an array for use in automation.
- [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations.md): Configure integrations that connect Cortex XDR to external services.
- [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/add-an-integration-instance.md): Add and configure an integration instance.
- [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the command-line interface.
- [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/troubleshoot-integations.md): Diagnose and resolve integration configuration and connectivity issues.
- [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/manage-credentials.md): Create and manage credentials for integration authentication.
- [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines.md): Install, manage, configure, and troubleshoot engines.
- [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/what-is-an-engine.md): Learn how engines run integrations and automation tasks.
- [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines.
- [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine.md): Install, deploy and configure Cortex XDR engines.
- [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XDR engines.
- [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions.
- [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers.
- [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers.
- [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker questions for engines.
- [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Diagnose and resolve Docker issues on engines.
- [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for engines.
- [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation directory on an engine.
- [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker environments used by Cortex XDR engines.
- [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md): Configure Docker network settings to improve engine security.
- [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md): Configure Docker images used by Cortex XDR engines.
- [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker containers with non-root internal users.
- [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure memory limits when swap is unavailable.
- [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure memory limits for Docker containers.
- [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure CPU, process, and file descriptor limits for Docker containers.
- [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify that Docker hardening settings are configured correctly.
- [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex XDR engines.
- [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine.
- [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex XDR engines.
- [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman.
- [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex XDR engines.
- [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/manage-engines.md): Manage engines and load balancing groups.
- [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex XDR or directly on the remote machine.
- [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system.
- [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines.md): Configure Cortex XDR engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations).
- [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine to connect through a web proxy.
- [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure an engine to connect directly without a proxy.
- [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for an engine.
- [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for a Cortex XDR engine.
- [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration.
- [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance.
- [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors.
- [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations that run on Cortex XDR engines.
- [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions.md): During the case investigation, various response actions are available.
- [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/initiate-a-live-terminal-session.md): Open a Live Terminal session on an endpoint.
- [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/isolate-an-endpoint.md): Isolate an endpoint to contain potential threats.
- [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/pause-endpoint-protection.md): Temporarily pause endpoint protection when required.
- [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/remediate-changes-from-malicious-activity.md): Remediate endpoint changes caused by malicious activity.
- [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/search-and-destroy-malicious-files.md): Locate and remove malicious files from endpoints.
- [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/manage-external-dynamic-lists.md): Create and manage external dynamic lists for enforcement.
- [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/collect-a-memory-image.md): Collect an endpoint memory image for forensic analysis.
- [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics.md): Collect and analyze endpoint evidence during forensic investigations.
- [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations.md): Start, manage, and review endpoint forensic investigations.
- [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation.md): Manage forensic investigations and their collected evidence.
- [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Create a forensic investigation, assign access, and start a data collection.
- [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Update an active investigation's details and user access.
- [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an investigation and manage its 24-hour grace period.
- [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation.
- [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection.md): Collect endpoint data for forensic investigation and analysis.
- [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/hunting.md): Hunt for evidence and suspicious activity in collected endpoint data.
- [Triage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/triage.md): Triage collected data to prioritize investigation findings.
- [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/configure-collection.md): Configure the endpoint data collected for forensic investigations.
- [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation.md): Analyze findings and document the forensic investigation.
- [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/review-alerts.md): Review alerts related to the forensic investigation.
- [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md): Review the timeline of events collected during an investigation.
- [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md): Review key assets and artifacts identified during an investigation.
- [Export](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/export.md): Export forensic investigation findings and collected evidence.
- [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder.
- [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats.
- [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder.
- [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started writing and running XQL queries.
- [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use the query builder interface to create and run XQL queries.
- [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply recommended practices when writing XQL queries.
- [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Define the expected results before writing an XQL query.
- [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query to search and analyze data.
- [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and refine the results returned by an XQL query.
- [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate supported search queries into XQL syntax.
- [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as a graph.
- [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder.
- [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-authentication-query.md): Query authentication events with the XQL dataset.
- [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-event-log-query.md): Query Windows event log data with XQL.
- [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-file-query.md): Query file activity data with XQL.
- [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-image-load-query.md): Query image load events with XQL.
- [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Query network connection data with XQL.
- [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-network-query.md): Query network event data with XQL.
- [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-process-query.md): Query process activity data with XQL.
- [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-registry-query.md): Query registry activity data with XQL.
- [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query across multiple datasets with XQL.
- [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant.
- [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit, test, and run XQL queries in the query builder.
- [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference XQL query syntax, functions, and commands.
- [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries.
- [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference fields and settings for scheduled XQL queries.
- [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-your-personal-query-library.md): Cortex XDR provides as part of the Query Library a personal library for saving and managing your own queries.
- [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/xql-macros.md): Create reusable XQL logic with query macros.
- [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-your-macros.md): Create, edit, and manage XQL query macros.
- [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions.
- [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/research-a-known-threat.md): Cortex XDR enables you to investigate any threat, also referred to as a lead, which has been detected.
- [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat.md): Chat with the Cortex Agentic Assistant using natural language prompts.
- [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable Agentic Assistant and access the chat interface.
- [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom agent for your chat.
- [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Tips for chatting with the Cortex Agentic Assistant
- [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Enable chatting with an Agentic Assistant agent from Slack.
- [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries.
- [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings.
- [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant.
- [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md)
- [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md)
- [Threat management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management.md): Detect, investigate, and respond to threats across your environment.
- [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence.md): Research threats, investigate indicators, and apply intelligence across Cortex XDR workflows.
- [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-threat-intel-library.md): Research curated threat actors, malware families, vulnerabilities, and reports from Unit 42.
- [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators, including domains, IP addresses, URLs, and file hashes.
- [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings in cases and issues.
- [XTI indicator rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicator-rules.md): Create rules that detect known threat indicators and generate issues from matching data.
- [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Query XTI indicators, threat objects, and their relationships using Cortex Query Language.
- [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-dashboard.md): Visualize threat intelligence data to monitor distribution, ingestion health, and emerging trends.
- [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Threat Intel Agent to list, enrich, and update XTI indicators.
- [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-in-playbooks.md): Automate XTI indicator triage, enrichment, and response with supported playbook commands.
- [Detection rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules.md): Create and manage rules that detect suspicious activity.
- [What's an IOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc.md): Learn how indicators of compromise identify known threats.
- [IOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc/ioc-rule-details.md): Review available fields and settings for IOC rules.
- [Create an IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc/create-an-ioc-rule.md): Create an IOC rule to detect and respond to known threats.
- [What's a BIOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc.md): Learn how behavioral indicators of compromise detect suspicious behavior.
- [BIOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/bioc-rule-details.md): Review available fields and settings for BIOC rules.
- [Create a BIOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/create-a-bioc-rule.md): Create a BIOC rule to detect suspicious behavior.
- [Manage Global BIOC Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/manage-global-bioc-rules.md): Manage Global BIOC rules across your organization.
- [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule.md): Learn how correlation rules connect related security events.
- [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/correlation-rule-details.md): Reference correlation rule fields, settings, and behavior.
- [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md): Create a correlation rule to detect related security events.
- [Field replacement syntax in correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/field-replacement-syntax-in-correlation-rules.md): Use field replacement syntax in correlation rule definitions.
- [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/manage-correlation-rules.md): Create, edit, and manage correlation rules.
- [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md): Monitor correlation rule execution and status.
- [Troubleshoot server errors in scheduled correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md): Resolve server errors in scheduled correlation rules.
- [Manage IOC and BIOC rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/manage-ioc-and-bioc-rules.md): Manage IOC and BIOC rules in Cortex XDR.
- [Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics.md): Use analytics to detect threats from correlated endpoint activity.
- [Analytics overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-overview.md): Understand Cortex XDR analytics and their threat detection coverage.
- [Analytics engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-engine.md): Learn how the analytics engine detects suspicious activity.
- [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-sensors.md): Learn about analytics sensors and the data they analyze.
- [Coverage of MITRE Attack tactics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/coverage-of-mitre-attack-tactics.md): Review analytics coverage aligned with the MITRE ATT\&CK framework.
- [Review MITRE ATT\&CK framework coverage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md): Review analytics rules mapped to MITRE ATT\&CK techniques.
- [Analytics detection time intervals](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-detection-time-intervals.md): Understand analytics time intervals and their effect on detection.
- [Analytics issues and Analytics BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-issues-and-analytics-biocs.md): Resolve analytics issues related to BIOC rules.
- [View and manage Analytics rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/view-and-manage-analytics-rules.md): View and manage analytics rules and their detection settings.
- [AI Detection & Response in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr.md): Use AI-driven detection and response to investigate potential threats.
- [Data sources and supported services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/data-sources-and-supported-services.md): Configure data sources for AI-driven detection and response.
- [Collect prompt logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs.md): Collect prompt logs for AI-driven detection and response.
- [Prompt log collection in AWS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/prompt-log-collection-in-aws.md): Configure AWS prompt logging for AI-driven detection and response.
- [Enable prompt log collection in Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure.md): Enable Azure data collection for AI-driven detection and response.
- [Configure the Azure Event Hub collection in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-the-azure-event-hub-collection-in-cortex-xsiam.md): Configure an Azure Event Hub to collect prompt logging data.
- [Set up prompt logging](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/set-up-prompt-logging.md): Set up prompt logging to collect AI activity data.
- [Log HTTP data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/log-http-data.md): Log HTTP data for AI-driven detection and response.
- [Configure diagnostic settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-diagnostic-settings.md): Configure diagnostic settings for AI activity data collection.
- [Attack surface management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management.md): Learn how to discover, monitor, and remediate external asset exposures with attack surface management.
- [Learn about Attack Surface Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management.md): Learn about Cortex XDR Attack Surface Management capabilities for finding, prioritizing, and remediating external asset exposures.
- [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/network-mapping.md): Learn how Cortex XDR discovers, attributes, and validates internet-facing assets to map your public attack surface.
- [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/scanning.md): Learn how Cortex XDR ASM scans internet-facing assets, monitors known assets, and identifies exposed services.
- [GeoIP data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/geoip-data-collection.md): Use GeoIP data to validate network distribution, identify location-based compliance risks, and route remediation efforts.
- [Attack Surface Management detections](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections.md): Review attack surface management detections and their details.
- [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-rules.md): Create and manage attack surface management rules.
- [Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-testing.md): Test attack surface management rules before deployment.
- [Externally inferred CVEs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/externally-inferred-cves.md): Review externally inferred CVEs affecting your attack surface.
- [Digital Risk Protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection.md): Monitor digital risk protection findings and related threats.
- [Attack surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-assets.md): The assets discovered in an attack surface management scan are called External Surface assets.
- [Deploy ASM and Exposure Management enrichment and remediation automation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation.md): Enable the Cortex Exposure Management playbooks to automate ASM and vulnerability issue enrichment and remediation.
- [ASM enrichment of cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/asm-enrichment-of-cloud-assets.md): ASM enrichment of cloud assets provides visibility into all the assets in your cloud infrastructure that are exposed to the internet.
- [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/emerging-vulnerabilities.md): Identify external exposures linked to emerging vulnerabilities, zero-day exploits, and global threat events on the Emerging Vulnerabilities page.
- [Global Lookup](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/global-lookup.md): Search global intelligence for indicators and related context.
- [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence.md): Evaluate and track asset compliance against industry standards and organizational policies.
- [Choose compliance standards from the compliance catalog](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog.md): Select built-in or custom compliance standards and controls from the compliance catalogs.
- [Standards catalog](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md): Browse available compliance standards.
- [Controls catalog](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/controls-catalog.md): Browse, filter, and review built-in and custom compliance controls.
- [Use a built-in or custom standard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-standard.md): Use built-in standards or create and edit custom standards for your organization.
- [Use a built-in or custom control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-control.md): Add built-in controls or create and manage custom controls for custom standards.
- [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/create-a-new-custom-detection-rule.md): Create custom detection rules to enforce compliance requirements and security best practices.
- [Use an assessment profile to run compliance checks on your assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets.md): Create assessment profiles to evaluate selected asset groups against compliance standards.
- [Configuring assessments for custom compliance standards based on custom cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets/configuring-assessments-for-custom-compliance-standards-based-on-custom-cloud-security-rules.md): Configure policies and assessments for custom standards that use custom cloud security rules.
- [View and manage compliance assessments and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md): Review assessment results and generate or schedule downloadable compliance reports.
- [Review assessments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/assessments.md): View assessment results and drill into control, rule, and asset compliance details.
- [Review reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/reports.md): View, export, and manage historical compliance assessment reports.
- [Compliance Overview Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/compliance-overview-dashboard.md): Monitor organization-wide compliance scores, standards, failed controls, and asset group performance.
- [Exposure management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management.md): Identify and prioritize security exposures across your environment.
- [Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management.md): Consolidate, prioritize, and remediate exposures across Palo Alto Networks and third-party data sources.
- [Get started with Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/get-started-with-exposure-management.md): Set up Exposure Management by configuring scanners, integrations, policies, security controls, and automation.
- [Ingest assets and vulnerabilities from third-party applications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/ingest-assets-and-vulnerabilities-from-third-party-applications.md): Ingest assets and vulnerabilities into Cortex Exposure Management from Palo Alto Networks sensors and third-party applications.
- [Security controls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/security-controls.md): Detect, create, and manage security controls to assess compensating-control effectiveness and residual risk.
- [Cortex Network Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/cortex-network-scanner.md): Use Cortex Network Scanner to identify network exposures.
- [Exposure Management Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management-command-center.md): Use the Exposure Management Command Center to prioritize exposures.
- [Vulnerability management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management.md): Learn how to identify, prioritize, and remediate vulnerabilities across your environment.
- [Vulnerability management in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-management-in-cortex-xdr.md): Vulnerability management helps you identify, assess, prioritize, and remediate security vulnerabilities across your entire IT infrastructure, including endpoints, code, and cloud.
- [Cortex Vulnerability Risk Score](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/cortex-vulnerability-risk-score.md): Learn how Cortex Vulnerability Risk Score prioritizes vulnerabilities using asset context and threat intelligence.
- [Vulnerability policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-policies.md): A vulnerability policy defines the action you want to take for a specific set of vulnerability findings.
- [Investigate and remediate vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/investigate-and-remediate-vulnerabilities.md): Learn how to investigate vulnerability issues, findings, and affected assets, then track remediation.
- [Vulnerability Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-intelligence.md): Vulnerability Intelligence is an in-product, real-time feed that provides vulnerability data and threat intelligence from a variety of certified upstream sources.
- [Recast CVSS scores and CVSS severities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/recast-cvss-scores-and-cvss-severities.md): Customize CVSS scores and CVSS severities in the platform to align your risk management approach with your organizational context and priorities.
- [Cortex Advanced Email Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security.md): Configure, monitor, and respond to email security threats.
- [Cortex Advanced Email Security module overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview.md): Learn how to onboard, configure, and operate the Email Security module.
- [Cortex Advanced Email Security module architecture and data flow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-architecture-and-data-flow.md): The Cortex Advanced Email Security module, a cloud-native system, integrates multiple components to ingest, analyze, and respond to email-borne threats effectively.
- [Getting started with the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/getting-started-with-the-cortex-advanced-email-security-module.md): High level deployment workflow
- [Deploy and configure the Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/deploy-and-configure-the-email-security-module.md): Configure the Microsoft O365 integration and the module.
- [Cortex Advanced Email Security threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues.md): The Cortex Advanced Email Security module uses artifact-based, metadata-driven, and LLM-powered engines to generate detections and insights.
- [Email Security Analytics Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues/email-security-analytics-rules.md): Manage analytics rules for Email Security detections.
- [Investigate and respond to email security issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/investigate-and-respond-to-email-security-issues.md): Investigate the issues generated by the Cortex Advanced Email Security module.
- [Automate remediation for the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module.md): Automated response actions through the Cortex Advanced Email Security module improve efficiency and reduce noise.
- [Email Remediation Response Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-remediation-response-rules.md): Manage Email Security response rules for remediation.
- [Email Security Remediation Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-security-remediation-action-center.md): Use the Email Security Remediation Action Center to manage actions.
- [Email Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center.md): View a dynamic overview of your email security status in the Email Command Center.
- [Malicious Email Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory.md): Triage, analyze, and act on malicious email threats
- [Mailbox Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/mailbox-inventory.md): View and manage your active email security assets
- [Advanced Email Security module security and compliance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/advanced-email-security-module-security-and-compliance.md): Configure security and compliance for the Advanced Email Security module.
- [Identity Threat Detection and Response (ITDR)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr.md): Detect, investigate, and respond to identity-based threats.
- [Get started with ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr.md): Get started with Identity Threat Detection and Response.
- [Manage role based access control (RBAC) in ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr.md): Configure ITDR permissions with role-based access control.
- [Monitor user risk exposure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure.md): Monitor user risk and prioritize potential threats.
- [Investigate user risk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk.md): Investigate user risks and related security activity.
- [Manage user asset roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles.md): Manage roles assigned to user assets.
- [Improve Active Directory posture with AD-SPM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md): Improve Active Directory security posture with AD-SPM.
- [Enforce dynamic access control with CAP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy.md): Enforce risk-based access control with Conditional Access Policies.
- [Prevent malicious LDAP queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md): Prevent malicious LDAP queries that target identity infrastructure.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.