> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents.md). # Incidents An incident is a collection of alerts related to a single service, or to a single asset if no service is detected. Incidents contain all the contextual data and assets from the related alerts. The **Incidents** page displays all your incidents to help you prioritize, track, investigate, and take remedial action. To access the **Incidents** page, navigate to **Incident Response** → **Incidents** . By default, the **Incidents** page is displayed in split-pane view, which is the recommended view for investigating and resolving incidents. Incidents split-pane view displays a side-by-side view of your incidents, with the Incident List in the left pane and corresponding incident Details Pane on the right. You can also view **Incidents** in table format. To toggle between split-pane view and table view of the Incidents page, click the table view icon ![table-view-icon.png](/files/bCA5nAqGgo5ncShOFbuf) in the upper right corner. ## Incident List Each incident in the incident list displays a summary of the incident severity, assignee, status, risk score, creation time, description, the number and severity of related alerts, and other information. Right-click an incident in the incident list to perform the following actions: * Update the incident assignee * Change incident status * Change incident severity * Star the incident * Get a link to the incident * Manage the risk score for the incident * View the incident in a new tab To perform these actions on a batch of two or more incidents, select the checkboxes for the incidents to be updated, right click, and select the desired action. You can filter, sort, and search alerts in both split-pane view and table view. Refer to the following resources for additional information: * See [Filter Page Results](/cortex-xpanse/reference/list-view-options/filter-page-results.md) for information about filtering tables. * See [Search Page Results](/cortex-xpanse/reference/list-view-options/search-page-results.md) for details about how to search within tables. * See [Incidents Fields](/cortex-xpanse/incidents-and-alerts/incidents/incidents-fields.md) for descriptions of the fields in the Incidents list. ## Incident Details Select an incident in the incident list to display the incident details in the right pane. The incident details pane is organized into an incident summary at the top of the pane and six tabs. The following list provides an overview of the information displayed and the updates you can make on the incident summary and on each of the tabs. * **Incident Summary** (at the top of the details pane) Displays a summary of the incident, including assignee, status, risk score, and tags. Update the incident assignee and status. Click on the Risk Score to view the scoring information and set the risk score manually. Add a comment or note to the incident. * **Overview** tab Displays the **Severity**, **Alert Description**, and **Playbook Status** of each alert related to the incident. Update the severity of the alerts, change **Alert Status**, and **Provide Input** to the playbook for each alert. * **Alerts** tab Displays detailed information about each alert, including the attack surface rule that triggered the alert, remediation guidance, and playbook details. Update the severity and status of each alert and provide playbook input. * **Assets** tab Displays **Asset Attribution Evidence** and additional details about the assets and services related to the incident. Click the **Know More about** link next to the asset to pivot to the asset details in the **Inventory**. * **Service/Website** tab Displays service or website classification details. * **Risk** tab Displays details about the inferred CVEs and risk factors associated with alerts in the incident. Click on the relevant links to learn more about the CVEs and risk factors. * **Timeline** tab Displays a chronological list of the actions that impacted the alert, including playbook actions and manual updates. Click on an action in the timeline to display additional details. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.