> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack.md). # Cortex Response and Remediation content pack Use Response and Remediation playbooks to automate incident workflows in Cortex XSIAM. The Cortex Response and Remediation content pack delivers a powerful collection of automated playbooks designed to streamline incident response and remediation processes, built to support an Autonomous SOC vision in Cortex XSIAM. The playbooks in this pack are tightly coupled to Issues, leveraging detector logic to provide highly accurate and context-aware responses. This ensures seamless integration with Cortex XSIAM, enabling SOC teams to focus on high-priority threats while automating repetitive tasks. ### **Key principles of the Cortex Response and Remediation playbooks** * **Focused Security Response:** Playbooks prioritize high-quality security responses while delegating bureaucratic tasks to incident-level or sub-playbooks. * **Research-Based Design:** The playbooks in the Cortex Response and Remediation pack are designed by the Cortex and Prisma Research team with extensive expertise and knowledge in responding to incidents and issues. * **Detector Alignment:** Playbooks are tailored to specific Cortex or Prisma issues, ensuring precision by aligning with detector logic. * **Cortex Analytics Integration:** Playbooks leverage Cortex analytics capabilities to derive precise verdicts for accurate and effective remediation. * **AI-driven Investigations:** Advanced AI capabilities enrich investigations by providing deeper insights and contextual data to improve decision-making. * **Clear Design:** Understandable within minutes. ### **Playbook features** * **Prebuilt:** Use out-of-the-box (OOTB) playbooks to ensure rapid deployment and reliable functionality. * **Context-aware Actions:** Implement responsive actions based on issue triggers. * **Seamless Integrations:** Fully compatible with Palo Alto Networks products and compatible with third-party solutions. * **Granular Monitoring:** Provides detailed logs for tracking execution. ### **Integrations in the Cortex Response and Remediation content pack** For a full list and description of each of the integrations in the Cortex Response and Remediation content pack, see the *Content* tab in [Cortex Response And Remediation](https://cortex.marketplace.pan.dev/marketplace/details/CortexResponseAndRemediation/). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.