> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/research-a-known-threat.md). # Research a known threat Cortex XSIAM enables you to investigate any threat, also referred to as a lead, which has been detected. This topic describes the steps you can take to investigate a lead. A lead can be: * An issue from a non-Palo Alto Networks system with information relevant to endpoints or firewalls. * Users or hosts that have been reported as acting abnormally. * Information from online articles or other external threat intelligence that provides well-defined characteristics of the threat. To research a known threat 1. Use threat intelligence to build a Cortex Query Language (XQL) query using the Query Builder. For example, if external threat intelligence indicates a confirmed threat involving specific files or behaviors, search for those characteristics. 2. Review and refine the query results by using filters and running follow-up queries to find the information you are looking for. 3. Select an event of interest, and open the **Causality view**. Review the chain of execution and data, navigate through the processes on the tree, and analyze the information. 4. Open the **Timeline** to view the sequence of events over time. If deemed malicious, take action using one or more of the response actions. 5. Inspect the information again, and identify any characteristics you can use to create a BIOC or correlation rule. If you can create a BIOC or correlation rule, test and tune it as needed. For more information, see [Create a correlation rule](/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md) and [Create a BIOC rule](/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/create-a-bioc-rule.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/research-a-known-threat.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.