> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-a-starring-configuration.md).

# Create a starring configuration

Create Cortex XSIAM starring rules to automatically prioritize matching issues and their linked cases.

Create a Cortex XSIAM starring configuration to automatically flag priority issues and linked cases. Define issue-based criteria to focus investigations on the most relevant cases.

### Create an issue and case starring rule

1. Select Cases & Issues → Case Configuration → **Starred Issues**.
2. Select **Add Starring Configuration**.
3. Under **Configuration Name**, enter a name for the issue and case starring rule.
4. (Optional) Under **Comment**, enter a descriptive comment.
5. In the issue table, use the filters to define the issue attributes you want to include in the match criteria. For example, you can select issues with High severity, issues by category, or issues associated with certain assets or asset providers.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Tip</h3><p>Right-click an issue field to add it as match criteria.</p></div>
6. Click **Create**.

<details>

<summary>Scope-Based Access Control for starring configurations</summary>

Case starring supports Scope-Based Access Control (SBAC). The following parameters apply when you edit a starring configuration:

* If **Scope-Based Access Control (SBAC)** is enabled and the **Endpoint Scoping Mode** is set to restrictive mode, you can edit a configuration if you are scoped to all tags in the configuration.
* If **Scope-Based Access Control (SBAC)** is enabled and the **Endpoint Scoping Mode** is set to permissive mode, you can edit a configuration if you are scoped to at least one tag listed in the configuration.
* If a policy was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-a-starring-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
