Create a case domain

Create custom Cortex XSIAM case domains to organize case workflows, statuses, resolution reasons, and access control.

Before you add a custom domain, please review the built-in options. For more information, see Case and issue domains.

We recommend using the built-in domains where possible. Custom domains might not be supported by all content. In addition, custom domains affect Cortex XSIAM’s ability to learn, correctly identify, and score future cases.

Smart grouping and SmartScore are not supported for custom domains.

Create custom Cortex XSIAM case domains to separate work efforts and organize case management workflows. Each domain can use tailored statuses, resolution reasons, and access controls.

Manage Cortex XSIAM case domains

View all case domains under Configurations → Object Setup → Cases → Domains. You can edit built-in domain properties and create custom domains.

Consider the following information:

• You can't merge cases with different domains.
• SmartScore and smart grouping are not supported for custom domains.
• For SBAC, use the Cases and Issues scoping area to define case and issue domains that enable you to control access to your domains. For more information, see Manage user scope.
• Domains might affect custom content that is connected to cases and issues. Review your custom content to ensure it is associated with the intended domains. This includes:

  • Automation Rules
  • Starring Rules
  • Notifications
  • Issue Exclusions
  • Scoring Rules
  • XQL that accesses the cases or issues datasets in Scheduled Queries and Widgets

Create a custom Cortex XSIAM case domain

• Adding custom domains requires a View/Edit RBAC permission for Case Properties (under Object Setup).
• Once created, a custom case domain cannot be deleted or renamed.

1. Go to Settings → Configurations → Object Setup → Cases → Domains .

   The existing domains are listed.
2. Click on + New Domain.
3. Assign a name and color to the domain, and an optional description.
4. In the Status field, select one or more statuses that are relevant to the domain. These statuses will be available for selection in the cases and issues associated with this domain.
5. In the Resolution Type field, select one or more resolution reasons that are relevant to the domain. These reasons will be available for selection in the cases and issues associated with this domain.
6. Click Save.
7. (Optional) Update SBAC scoping to enable access to the domain.

   1. You can perform the following:

      • To enable access to the domain for a User Group, go to Settings → Configurations → Access Management → User Groups.
      • To enable access to the domain for a User, go to Settings → Configurations → Access Management → Users.
      • To enable access to the domain for an API key, got to Settings → Configurations → Integrations → API Keys.
   2. When editing an existing User Group, User, or API key, in the Scope tab you can update the granular scoping for the new Endpoints domain.
   3. Click Save.