> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/causality-icons-key.md).
# Causality icons key
The following tables describe the causality chain icons, broken down by type:
### **Action icons**
Causality action icons mark the actions that were taken on a process or event. Pending actions are shown with a dotted line.
Icon
Description
Blocklist
Quarantine
Allowlist
### **Causality alert icons**
Causality alert icons indicate the type of alert that was triggered.
| Icon | Description |
| ------------------------------------------------------------------------------------------------------------ | ------------------ |
| | 3rd party |
| | XDR Agent |
| | Analytics |
| | BIOC |
| | Firewall |
| | General alert |
| | Identity analytics |
| | IOC |
**Examples**
A number next to the alert icon indicates that there are multiple alerts. This icon show that there are three alerts and the selected alert is a BIOC alert. You can scroll through the alerts in the **Information Overview**.
This example shows AI activity from the Microsoft Copilot was detected.
### **Cloud event icons**
Cloud event icons indicate the type of cloud event or process.
| Icon | Description |
| --------------------------------------------------------------------------------------------------------------- | ------------------------- |
| | Cloud admin |
| | Compute disks |
| | Compute instances |
| | Container escaped |
| | Drive |
| | Exchange |
| | General resource |
| | Groups |
| | Images |
| | Network |
| | Onedrive |
| | Security groups- FW rules |
| | Sharepoint |
| | Skype |
| | Storage buckets |
| | Subnets |
| | Teams |
| | VPCs |
### **Event icons**
Event icons indicate the type of activity that occurred.
| Icon | Description |
| ---------------------------------------------------------------------------------------------------- | -------------------- |
| | AI tool |
| | DotNet |
| | Event log |
| | File |
| | Firewall |
| | Host |
| | Host group |
| | Identity analytics |
| | Internet |
| | Malware |
| | Mobile |
| | Module load |
| | Multi-user |
| | Network |
| | Potential prevention |
| | Range |
| | Registry |
| | TCP Protocol |
| | Server |
| | Unknown event |
| | User session |
| | VOIP |
| | VPN |
### **Left node icons**
Left node icons provide additional information about a process.
| Icon | Description |
| --------------------------------------------------------------------------------------------------- | ----------------------- |
| | Injected node |
| | Last actor |
| | Remote terminal session |
| | RPC |
| | Unknown process |
### **Node icons**
Node icons indicate the type of process or event that occurred in the chain.
| Icon | Description |
| ------------------------------------------------------------------------------------------------ | ----------------- |
| | Adobe |
| | Attachment |
| | Chrome |
| | Remote IP Address |
| | Email |
| | Endpoint |
| | Excel |
| | Firefox |
| | Generic process |
| | Internet Explorer |
| | IP address |
| | Link |
| | mySQL |
| | Outlook |
| | Powerpoint |
| | Putty |
| | Sender |
| | Unknown |
| | User |
| | Word |
### **Other icons**
| Icons | Description |
| -------------------------------------------------------------------------------------------------------- | ---------------------------- |
| | Benign |
| | Container |
| | Causality Group Owner (CGO). |
| | Default |
| | Grayware |
| | In-evaluation |
| | Malware |
| | Quarantine |
| | Still running |
| | Unknown sample |
| | User |
| | WF download |
| | WF download unsuccessful |
### **Examples**
The following example shows a XDR Agent alert was triggered on a File.
In this example, a NGFW alert was triggered on a TCP Protocol that called a remote IP address, that created an unknown process.
In this example, the highlighted process node represents the real parent that executed the process. Click on the node for more details about the parent process. The pen icon on the first process nodes indicates that this process is "last actor". The syringe icon on the last process node indicates that this process is an "injected node".
In this example, two alerts were triggered on an email that was sent to two recipients and included attachments and links.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/causality-icons-key.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.