> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md).

# Incident Status

The table below describes the incident statuses. Some of these statuses are assigned automatically by Xpanse and some are assigned manually by a user. You can manually change the status of any incident to any status.

Incidents typically move through a **New**→**Under Investigation**→**Resolved** workflow. However, after an incident has been resolved, Xpanse will reopen it with the status **New** if scans detect the asset on the internet again and a corresponding alert is generated.

<table data-header-hidden><thead><tr><th width="162.5"></th><th></th><th></th></tr></thead><tbody><tr><td>Incident Status</td><td>Description</td><td>Set by System or User or Both</td></tr><tr><td><strong>New</strong></td><td><p>Incidents have the status <strong>New</strong> in the following circumstances:</p><ul><li>Xpanse has created a brand new incident.</li><li>Xpanse has reopened a previously resolved incident because the asset was observed on the public internet again and Xpanse opened an alert for it.</li><li>A user has set the incident status to <strong>New</strong>.</li></ul></td><td>Both. The system sets the status to <strong>New</strong> for a new or reopened incident. A user can change the status to <strong>New</strong> anytime.</td></tr><tr><td><strong>Under Investigation</strong></td><td>Indicates that one or more alerts for the incident are <strong>In Progress</strong> or <strong>New</strong>.</td><td>User only</td></tr><tr><td><strong>Resolved</strong></td><td>When all the related alerts for an incident are resolved, the incident is marked <strong>Resolved</strong>.</td><td>Both. The system changes the status to <strong>Resolved</strong> when all the alerts have been resolved. A user can change the status to <strong>Resolved</strong> anytime.</td></tr></tbody></table>

## **Add Custom Alert and Incident Statuses and Resolution Reasons**

{% hint style="warning" %}

### Warning

Before you add a custom status, please review the built-in options. For more information see [Alert Status](/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md) and [Incident Status](/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md).

We recommend using the built-in statuses and resolution reasons where possible. Custom statuses and resolution reasons might not be supported by all content, and status syncing can take time.

In addition, custom statuses affect ability of Cortex Xpanse to learn, correctly identify, and score future incidents.
{% endhint %}

You can create custom alert and incident statuses and custom resolution reasons that are tailored to your workflow. Custom statuses and resolution reasons apply to both incident and alert statuses, and can also be used in playbooks.

Custom resolution types are always *nonterminal* (or *reopenable*). That means an incident that is resolved with a custom resolution will be reopened with the status **New** if scans detect the asset again an an alert is generated. An alert that is resolved with a custom resolution will be reopened with the status **Reopened**.

Adding custom incident statuses and resolution reasons requires a **View/Edi**t RBAC permission for **Incident Properties** (under **Object Setup**).

1. Go to **Settings** → **Configurations** → **Object Setup** → **Incidents**.

   The existing statuses and resolution types are listed.
2. In the\*\* Add another status\*\* field, type a new status and click **Save**.
3. Click \*\*Edit \*\*to rearrange the order of the statuses. This order is presented when you set a status or select a resolution type.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.