> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md).

# Create a Threat Intel Report

Create a threat intelligence report from a type and layout in Cortex XSOAR 6.15.

You can create a threat intel report by choosing a type and defining other basic report information. To customize the threat Intel report such as creating new types, layouts, etc., see [Threat Intel Reports Customization](/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization.md).

Before you create a report, make sure you [set up threat intel report types](/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization.md) to ensure that your type is defined correctly. The creation process generates a blank report based on the type you choose. Once created, you need to edit the report to populate it with relevant content before you [Generate a Threat Intel Report](/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/generate-a-threat-intel-report.md).

The core of the report is the Report Body, which is used to enter freeform text. After report creation, you can edit any predefined template text in this section and replace it with your own content. Using the Markdown Editor, you can apply rich formatting options to the body text, including text sizing, coloring, formatting, pictures/icons, and section headers.

1. Go to Threat Intel → **Threat Intel Reports**
2. Create a **New Threat Intel Report** from the button at the top right.
3. In the **Report Details** section, enter a **Name** and [Type](/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-types.md), and configure any other relevant fields.
4. In the **Permissions** section, assign **Roles** that you want to grant read/write access to the report.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you don’t assign any roles to a report, all roles will have read/write access for the report.</p></div>
5. **Create** the report.

   The report is displayed.
6. From the **Summary** tab, you can edit report fields as needed and add any information pertaining to the specific report.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.