> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/saas-causality-view.md).

# Saas causality view

The SaaS causality view provides a powerful way to analyze and investigate software-as-a-service (SaaS) related issues for audit stories, such as Office 365 audit logs and normalized logs, by highlighting the most relevant events and issues associated with a SaaS-related issue. To help you identify and investigate SaaS-specific data associated with SaaS-related issues and SaaS audit logs, Cortex XDR displays a SaaS causality view, which enables you to swiftly investigate a SaaS issue by displaying the series of events and artifacts that are shared with the issue.

A SaaS causality view is only available when Cortex XDR is configured to collect SaaS audit logs and data. For example, this is possible by configuring an Office 365 data collector or Google Workspace data collector with the applicable SaaS audit logs. This enables you to investigate any Cortex XDR issue generated from any IOC, BIOC, or correlation rules, including SaaS events. The SaaS causality view is available from the **Issues** table, or from the **Query Results** after running a query on the SaaS related data. From both places, you can right-click to pivot to the SaaS causality view.

The scope of the SaaS causality view is the Causality Instance (CI) of an event to which this issue pertains. The SaaS causality view presents the event identity and /or IP address and the actions performed by the identity on the SaaS resource. On each node in the CI chain, Cortex XDR provides information to help you understand what happened around the event.

The SaaS causality view contains the following sections:

<details>

<summary>Information Overview</summary>

Summarizes information about the issue you are analyzing, including the type of SaaS provider, project, and region on which the event occurred. Select **View Raw Log** to view the raw log as provided by the SaaS provider in JSON format.

</details>

<details>

<summary>SaaS causality instance chain</summary>

Includes the graphical representation of the SaaS Causality Instance (CI) along with other information and capabilities to enable you to conduct your analysis.

The SaaS causality view presents a single event CI chain. The CI chain is built from Identity and Resource nodes. The Identity node represents for example keys, service accounts, and users, while the Resource node represents for example network interfaces, storage buckets, or disks. When available, the chain can also include an IP address and issues that were triggered on the Identity and SaaS resource.

* **Identity node:** Displays the name of the identity, generated issue information, and if available the associated IP address.
* **IP address node:** Displays the IP address associated with the Identity.
* **Resource node:** Displays the referenced resource on which the operation was performed. Cortex XDR displays information on the following resources.

**Navigation**

You can move the chain, extend it, and modify it. To adjust the appearance of the CI chain, use the size controls on the right. You can also move the chain by selecting and dragging it. To return the chain to its original position and size, click ![causality-view-reset-icon.png](/files/3PKn3dZbKcKFOFbwkLwB) in the lower-right of the CI graph.

</details>

<details>

<summary>All Events table</summary>

Displays up to 100,000 related events and up to 1,000 related issues. In the **All Events** table, Cortex XDR displays detailed information about each of the related events. To simplify your investigation, Cortex XDR scans your Cortex XDR data aggregating the events that have the same Identity or Resource and displays the entry with an ![cloud-causality-aggregated-events.png](/files/fV4AHkx6Fki5jKPmK9Bl) aggregated icon. Right-click and select **Show Grouped Events** to view the aggregated entries.

Entries highlighted in red indicate that the specific event created an issue. To continue the investigation, right-click to **View in XQL**. To continue the investigation, in the **Issues** table, right-click an issue to see the available actions.

</details>

<details>

<summary>Key of SaaS resources</summary>

The following table lists the SaaS resource icons:

<table><thead><tr><th width="122">Icon</th><th>Type of resource</th></tr></thead><tbody><tr><td><img src="/files/v1vpJSUpg6QcoW32vRag" alt="saas-resource-1.png"></td><td>Google Workspace Admin Console</td></tr><tr><td><img src="/files/CYGfXN9ZZzVrhXofx8tR" alt="saas-resource-2.png"></td><td>Google Workspace for Google Drive</td></tr><tr><td><img src="/files/HKXj4n4QYvKNF7fDcWpE" alt="saas-resource-3.png"></td><td>Microsoft Office 365 Exchange Online</td></tr><tr><td><img src="/files/34MgaNKC2DyEuyJSuPE2" alt="saas-resource-4.png"></td><td>Microsoft 365 Office Groups</td></tr><tr><td><img src="/files/JuL9yvIXm44AxKJnev6p" alt="saas-resource-5.png"></td><td>Microsoft Office 365 OneDrive</td></tr><tr><td><img src="/files/yTUigWPIguhpIMpxQPwg" alt="saas-resource-6.png"></td><td>Microsoft Office 365 SharePoint Online</td></tr><tr><td><img src="/files/XrKIG2PyiQ4yy9A8KZ1c" alt="saas-resource-7.png"></td><td>Microsoft Office 365 Skype for Business</td></tr><tr><td><img src="/files/PXVvhWlJvoru1HeTFnWl" alt="saas-resource-8.png"></td><td>Microsoft Office 365 Teams</td></tr></tbody></table>

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/saas-causality-view.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.