> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/optimize-case-grouping-in-correlations.md). # Optimize case grouping in correlations When custom detections (such as correlation rules) generate issues, those issues might not group automatically into related cases—even when they appear related from a user perspective. Case grouping is determined by Cortex XSIAM’s broader grouping and machine learning logic, which evaluates relationships, context, and shared artifacts across issues. To optimize how Cortex XSIAM groups issues triggered by correlations, you can map specific fields that influence grouping and prioritization. ### **Why field mapping matters in issue grouping** Cortex XSIAM’s grouping and machine learning models use specific fields to construct grouping artifacts. These artifacts are then used to evaluate whether issues are related to each other or to an ongoing activity. Not all fields influence grouping. To contribute effectively to grouping and prioritization, your correlation rules must supply one or more of the relevant fields in a supported format that Cortex XSIAM can interpret. In addition, ensure that the mapped fields adhere to the correct field structure, and expected formatting requirements. If these fields are missing, incorrectly mapped, or improperly formatted, Cortex XSIAM may be unable to correlate related issues accurately. This can reduce grouping effectiveness and lead to unnecessary issue fragmentation across multiple cases. Benefits of proper grouping configuration: * Correlate related custom issues into a single investigative workflow * Reduce issue and case fragmentation * Reduce over grouping of issues in cases * Improve investigation efficiency * Strengthen ML-based prioritization and correlation * Align custom detections with organizational context {% hint style="info" %} Field mapping does not guarantee grouping. Cortex XSIAM grouping uses machine learning and platform logic that evaluates confidence, context, relationships, and additional case signals. Field mapping helps influence grouping by contributing relevant artifacts, but final grouping decisions are determined by the platform’s overall grouping logic. For more information about case grouping behavior, see [Case grouping](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/optimize-case-grouping-in-correlations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.