> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page.md).
# Overview of the Issues page
The **Issues** page consolidates all non-informational issues from your detection sources. By default, the **Issues** page displays the security issues received over the last seven days. To access the **Issues** page, go to Cases & Issues → Issues.
Each issue is linked to one or more cases. A case provides the full story of a problem by linking related issues, assets, and artifacts in one place. To make sure that you understand the full picture of how an issue fits into the bigger picture, we recommend that you start your investigation from the **Cases** page. You can see the issues linked to a case in the **Issues & Insights** tab of the selected case. Click on an issue to open the Issue card. For more information, see [Issue card](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-card.md).
For issues associated with the Health domain, these issues are not linked to cases and should be investigated individually. You can also see Health domain issues on the **Health Issues** page. For more information, see [About health issues](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues.md).
{% hint style="info" %}
### Note
Every 12 hours, the system enforces a cleanup policy to remove the oldest issues once the maximum limit is exceeded. The default issue retention period in Cortex XSIAM is 186 days.
{% endhint %}
### **Saved table views**
On the **Issues** page, you can change the displayed information by changing the table view. When you open the page, the **Security Domain** table view is displayed. Click the displayed table view to see your predefined and custom table views. You can create custom table views from scratch or by editing the predefined options.
Standardized format of user names in issues
Names of users are processed and displayed the in the following standardized format, also termed “normalized user”.
***``*****`\`*****``***
As a result, any issue triggered based on network, authentication, or login events displays the **User Name** in the standardized format in the **Issues** and **Cases** pages. This impacts every issue for Cortex XSIAM Analytics and Cortex XSIAM Analytics BIOC, including Correlation, BIOC, and IOC issues triggered on one of these event types.
Deduplicated FW issues
To reduce noise in your environment, if firewall issues with the same name and host are raised within 24 hours, the issues are deduplicated. A label indicates the number of deduplicated issues up to 1,000 issue counts, larger quantities display as 1000+.
For more information, see [Issue deduplication](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-deduplication.md).
Featured fields
You can highlight issues that are important to you by tagging specific issue attributes, such as host names, user names, IP addresses, and Active Directory, as featured fields. This can help you track issues. For more information, see [Create a featured field](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field.md).
Issue fields
To see a full list of issue fields and descriptions, run the following query in the **Query Builder**:
```programlisting
datamodel dataset = issues
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.