> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/create-a-case.md). # Create a case {% hint style="info" %} ### Note To create a case manually, you must have View/Edit permission for **Cases and Issues** selected under **Settings** → **Configurations** → **Access Management** → **Roles** → **Components** → **Cases & Issues**. {% endhint %} You can create a case directly from the **Cases** page. 1. On the **Cases** page click **New Case**. 2. Under **Case Details**, specify the case domain, name, severity, and (Optional) assignee and description. The severity of a manually generated case cannot be low.

Note

You can assign a case to a single domain only, and you cannot change the assigned domain. For more information, see Case and issue domains.

3. (Optional) Under **Case Fields**, select custom case fields. Cortex XSIAM validates the **Host IP**, **Local IP**, and **Remote IP** fields. If you select **Set fields as default for new \ domain cases**, the custom case fields that are configured are saved for all users. When a user next creates a case for the same domain, these fields are automatically configured instead of the default field set. To reset the custom fields to the system default, click **Restore Default Field Set**. 4. Under **Issue Details**, select the issues to link to the case, or create a new issue.

Tip

The issues that you link to a case can be linked to multiple cases, and the issue domains do not need to match the case domain.

5. Under **Issue Fields**, define the following:

Note

This option is only relevant for certain domains.

* MITRE ATT\&CK tactics and techniques to assign to the case. * Custom issue fields. 6. (Optional) Under **Playbook**, specify playbook run settings. By default, a playbook is run **Automatically by trigger**.

Note

This option is only relevant for certain domains.

7. Click **Create new case**. Each case creation generates one issue. The name, the severity, and the description of the generated issue mirrors the name, the severity, and the description of the case.

Note

You can't attach files to manually created cases.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/create-a-case.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.