> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/example-use-cases.md).

# Example use cases

The following are examples of Cortex Response and Remediation use cases.

### **SSO password spray**

* **Detection:** Identifies suspicious login attempts against SSO endpoints.
* **Triage:** The playbook checks the IP reputation and fetches the events related to the SSO login attempts.
* **Early Containment:** The playbook checks if the IP is suspicious. If it is, the playbook suggests blocking the IP.
* **Investigation:**
  * The playbook assesses the risk score of the user who successfully logged in and examines the legitimacy of the user agent.
  * It verifies if the user has MFA configured and analyzes the timestamps of the login attempts to detect potential malicious automated patterns.
* **Containment:**
  * If there is a successful login attempt and the user's risk score is high, or if the user agent is detected as suspicious, or if the time intervals were automated, the playbook clears the user's session.
  * If the user doesn't have MFA, the playbook recommends expiring the user's password.
* **Requirements:** For any response action, you need one of the following integrations:
  * Microsoft Graph User
  * Okta

### **Credential dumping using a known tool**

* **Detection:** Recognizes credential dumping activities.
* **Response:**
  * **Early Containment:** Handles malicious issues by terminating the causality process.
  * **Remediation:** Handles malicious issues by suggesting the analyst to isolate the endpoint. endpoints identified in the detection.

### **User added to local administrator group using PowerShell**

* **Detection:** Detects unauthorized privilege escalations via PowerShell commands.
* **Response:**
  * **Investigation:** Check the following parameters to determine if remediation actions are needed:
    * Cortex XSIAM issues related to the hostname by MITRE tactics indicating malicious activity.
    * Whether the process is unsigned.
  * **Remediation:** Handles malicious issues by terminating the relevant processes and requesting the analyst's approval to remove the user from the local Administrators group. Handles non-malicious issues identified during the investigation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/example-use-cases.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.