> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md). # Causality icons key Use the causality icons key to interpret investigation data in causality chains in Cortex XSIAM. The following tables describe the causality chain icons in Cortex XSIAM, broken down by type: ### **Action icons** Causality action icons mark the actions that were taken on a process or event. Pending actions are shown with a dotted line. | Icon | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | | Blacklist__action_icon_.pngBlacklist_-_pending__action_icon_.png | Blocklist | | Quarantine__action_icon_.pngQuarantine_-_pending__action_icon_.png | Quarantine | | Whitelist__action_icon_.pngWhitelist_-_pending__action_icon_.png | Allowlist | ### **Causality alert icons** Causality alert icons indicate the type of alert that was triggered. | Icon | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | | 3rd_party__causality_alert_icon_.png | 3rd party | | Agent__causality_alert_icon_.png | XDR Agent | | Analytics__causality_alert_icon_.png | Analytics | | BIOC__causality_alert_icon_.png | BIOC | | Firewall__causality_alert_icon_.png | Firewall | | General_alert__causality_alert_icon_.png | General alert | | Identity_analytics__causality_alert_icon_.png | Identity analytics | | IOC__causality_alert_icon_.png | IOC | **Examples** A number next to the alert icon indicates that there are multiple alerts. This icon show that there are three alerts and the selected alert is a BIOC alert. You can scroll through the alerts in the **Information Overview**. ![Muliple\_BIOC\_alerts.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-6429771b8db1ad194a390e57acd6a9d1429b657f%2Fa02cb250fceb0a18f8e3149097f692cd704041e48bb64bcc991427241e59a9f1.png?alt=media) This example shows AI activity from the Microsoft Copilot was detected.
### **Cloud event icons** Cloud event icons indicate the type of cloud event or process. | Icon | Description | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | | Cloud_admin__cloud_event_icon_.png | Cloud admin | | Compute_disks__cloud_event_icon_.png | Compute disks | | Compute_instances__cloud_event_icon_.png | Compute instances | | Container_escaped__cloud_event_icon_.png | Container escaped | | Drive__cloud_event_icon_.png | Drive | | Exchange__cloud_event_icon_.png | Exchange | | General_resource__cloud_event_icon_.png | General resource | | Groups__cloud_event_icon_.png | Groups | | Images__cloud_event_icon_.png | Images | | Network_interfaces__cloud_event_icon_.png | Network | | Onedrive__cloud_event_icon_.png | Onedrive | | Security_groups-_FW_rules__cloud_event_icon_.png | Security groups- FW rules | | Sharepoint__cloud_event_icon_.png | Sharepoint | | Skype__cloud_event_icon_.png | Skype | | Storage_buckets__cloud_event_icon_.png | Storage buckets | | Subnets__cloud_event_icon_.png | Subnets | | Teams__cloud_event_icon_.png | Teams | | VPCs__cloud_event_icon_.png | VPCs | ### **Event icons** Event icons indicate the type of activity that occurred. | Icon | Description | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | | DotNet__event_icon_.png | AI activity | | DotNet__event_icon_.png | DotNet | | Event_log__event_icon_.png | Event log | | File__event_icon_.png | File | | Firewall__event_icon_.png | Firewall | | Host__event_icon_.png | Host | | Host_group__event_icon_.png | Host group | | Identity_analytics__event_icon_.png | Identity analytics | | Internet__event_icon_.png | Internet | | Malware_alert__event_icon_.png | Malware | | Mobile__event_icon_.png | Mobile | | Module_load__event_icon_.png | Module load | | Multi-user__event_icon_.png | Multi-user | | Network__event_icon_.png | Network | | Potential_prevention__event_icon_.png | Potential prevention | | Range__event_icon_.png | Range | | Registry__event_icon_.png | Registry | | Router__event_icon_.png | TCP Protocol | | Server__event_icon_.png | Server | | Unknown__event_icon_.png | Unknown event | | User_session__event_icon_.png | User session | | VOIP__event_icon_.png | VOIP | | VPN__event_icon_.png | VPN | ### **Left node icons** Left node icons provide additional information about a process. | Icon | Description | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | | Injection__left_node_icon_.png | Injected node | | Last_actor__left_node_icon_.png | Last actor | | Remote_IP__left_node_icon_.png | Remote terminal session | | RPC__left_node_icon_.png | RPC | | Unknown_process__left_node_icon_.png | Unknown process | ### **Node icons** Node icons indicate the type of process or event that occurred in the chain. | Icon | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | | | Adobe | | Attachment__node_icon_.png | Attachment | | Chrome__node_icon_.png | Chrome | | Cloud__node_icon_.png | Remote IP Address | | Email__node_icon_.png | Email | | Endpoint__node_icon_.png | Endpoint | | Excel__node_icon_.png | Excel | | Firefox__node_icon_.png | Firefox | | Generic_process__node_icon_.png | Generic process | | Internet_Explorer__node_icon_.png | Internet Explorer | | IP__node_icon_.png | IP address | | Link__node_icon_.png | Link | | mySQL__node_icon_.png | mySQL | | Outlook__node_icon_.png | Outlook | | Powerpoint__node_icon_.png | Powerpoint | | Putty__node_icon_.png | Putty | | Sender__node_icon_.png | Sender | | Unknown__node_icon_.png | Unknown | | User__node_icon_.png | User | | Word__node_icon_.png | Word | ### **Other icons** | Icons | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | | Benign.png | Benign | | Container.png | Container | | CGO__text_icon_.png | Causality Group Owner (CGO). | | Default__other_icon_.png | Default | | Grayware.png | Grayware | | In-evaluation.png | In-evaluation | | Malware.png | Malware | | Quarantine__other_icon_.png | Quarantine | | Still_running__text_icon_.png | Still running | | Unknown_sample.png | Unknown sample | | User__text_icon_.png | User | | WF_Download__other_icon_.png | WF download | | WF_Download_unsuccessful__other_icon_.png | WF download unsuccessful | ### **Examples** The following example shows a XDR Agent alert was triggered on a File. ![Example\_Agent\_alert.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-8fe97d9a04e639c4259a2b96920ede33e327cda2%2F57a86c3ad4737f08e7badc6cc44ad62d501dc86ae89b52b23506d5a6c5a9c9bf.png?alt=media) In this example, a NGFW alert was triggered on a TCP Protocol that called a remote IP address, that created an unknown process. ![Example\_NGFW\_alert.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-ef10941e83826ddb7498d903c6796c3ef7d6921a%2Ff0db7947a9c02b1997ad7773e3a2ac6b6121ad6c17a128a6d0f52ad8fb769caf.png?alt=media) In this example, the highlighted process node represents the real parent that executed the process. Click on the node for more details about the parent process. The pen icon on the first process nodes indicates that this process is "last actor". The syringe icon on the last process node indicates that this process is an "injected node". ![Example\_starting\_process.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-d33c1bd748480f2bf905e751e7005c72fef211bf%2F64402cff61a49d854774a9d6696a231934d9ede6156b04b39383afcb7c4a8b49.png?alt=media) In this example, two alerts were triggered on an email that was sent to two recipients and included attachments and links. ![Example\_Email\_alert.png](https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2Fgit-blob-439afec4940f47c4b896749531695b60598359aa%2Fece3dd7261e3b0ba26ca5a49346d2492e0f5b440c24eef46bd69417b0713ddd1.png?alt=media) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.