> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/investigate-an-issue-using-cortex-response-and-remediation-playbooks.md). # Investigate an issue using Cortex Response and Remediation playbooks Issues help you to monitor and control the security of your system framework by alerting you to security risks in your framework. Cortex XSIAM generates issues from the following: * Agents * Firewalls * Analytics * Integrations By analyzing an issue, you can better understand the cause of the issue, and take actions where required.
Select an issue to investigate The **Issues** page displays a table of the issues associated with the incident. By default, the **Issues** page displays the security issues received over the last seven days. To see detailed information about an issue, click an issue to open the issue panel. You can then investigate the issue further by opening the issue investigation panel. 1. Go to **Cases & Issues** → **Issues**. ![issues.png](/files/hlpRlHqmu10C0q9cOx9O) 2. Click the issue and review the information in the issue side panel. ![issue\_details.png](/files/iy48pR9xfcNeQXXNPpfq) 3. To see more information about the issue, click the **Issue Overview** tab. ![alert\_overview.png](/files/gmxoTxljEGlDwxUlI0MA)
Run a Cortex Response and Remediation playbook The Cortex Response and Remediation playbooks are a series of tasks, scripts, conditions, commands, and loops that run in a predefined flow to save time and improve the efficiency and results of the investigation and response process. They enable you to automate many security processes, including handling investigations and managing tickets. In the Work Plan tab, you can select a playbook to run on the issue. You can watch the flow of the playbook as it automatically analyzes the issue. 1. Go to **Cases & Issues → Issues**. 2. Click the issue and review the information in the issue side panel. 3. In the Issue Investigation panel, click the **Work Plan** tab. A message appears that recommends which Cortex Response and Remediation playbook you should run on this issue. 4. Click **Run**. A single instance of the playbook will run.
Adopt a automation rule suggestion An automation rule is a filter on an issue that creates conditions, so if an issue with specific characteristics is created (for example by source, severity, or MITRE TTP), a suitable response is issued via a playbook. This saves the analyst time and expense when investigating an issue. You can assign a playbook to an issue so that whenever the same issue is triggered in the future, the same playbook will automatically run. You can add an automation rule from the **Automation R Recommendations** table. These playbooks are recommended to run whenever the issue is triggered. These recommendations are part of the *Cortex Response and Remediation* content pack. 1. Go to **Investigation & Response** → **Automation** → **Automation Rules**. 2. Click **View Recommendations**. 3. Select the automation rule you want and click **Add selected rules**.
Reviewing the playbook response After running the playbook, you can investigate an issue to gain more information about the cause of the issue, and take any actions required. In the issue investigation panel. The following tabs are common to most issue:
TabDescription
Issue Overview

A summary of the issue, such as issue details, outstanding tasks, and indicators. Some fields are informational and some are editable. Includes the following sections (depending on the layout):

  • ISSUE DETAILS: A summary of the issue, such as type, severity, and when the issue occurred. Update these fields as required.
  • COMMAND AND TASK RESULTS: Lists any manual commands and playbook task results.

  • WORK PLAN: When you click on the section, you can view or take action on the following:

    • Playbook tasks: When a playbook runs, any outstanding tasks appear. You can take various actions here or in the Work Plan tab.
    • To-Do Tasks: An ad-hoc item that is not attached to the Work Plan. Create tasks for users to complete as part of an investigation. These are like a To-Do list that you keep in an investigation on an ad-hoc basis rather than the Work Plan which follows a pre-defined process. You can view or create To-Do tasks.
  • NOTES: Helps you understand specific actions taken, and allow you to view conversations between analysts to see how they arrived at a certain decision. You can see the thought process behind identifying key evidence and identifying similar incidents.
  • MALICIOUS OR SUSPICIOUS INDICATORS: A list of any malicious or suspicious indicators. If you have the Threat Intel add-on you can pivot to the Indicators page, where you can take further action on the indicator.
Technical InformationDisplays an overview of the information collected about the investigation, such as indicators, email information, URL screenshots, etc. When you run a playbook, the sections are automatically completed.
Investigation ToolsEnables you to take action on the issue , such as converting a JSON file to CSV and check if the IP address is in CIDR.
War RoomA comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the issue investigation. Each incident has a unique War Room. For information, see Use the War Room in an investigation.
Work PlanA visual representation of the running playbook that is assigned to the incident. For more information, see Use the Work Plan in an investigation.
**Use the following steps to investigate and triage the issue:** 1. Review the data shown in the issue such as the command-line arguments (CMD), process info, etc. 2. Analyze the chain of execution in the causality view. When the app correlates an issue with additional endpoint data, the **Issues** table displays a green dot to the left of the issue row to indicate the issue is eligible for analysis in the causality view. If the issue has a gray dot, the issue is not eligible for analysis in the causality view. This can occur when there is no data collected for an event, or the app has not yet finished processing the EDR data. To view the reason analysis is not available, hover over the gray dot. 3. Review the timeline of the sequence of events over time. The timeline is available for issues that have been stitched with endpoint data. 4. If deemed malicious, consider responding by isolating the endpoint from the network. 5. Remediate the endpoint and return the endpoint from isolation.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/investigate-an-issue-using-cortex-response-and-remediation-playbooks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.