> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats.md). # Investigate and Respond to Threats - [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8.10 On-prem. - [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Investigate and remediate security incidents in Cortex XSOAR 8.10 On-prem. - [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8.10 On-prem. - [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search and save incident queries in Cortex XSOAR 8.10 On-prem. - [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create, ingest, or import incidents in Cortex XSOAR 8.10 On-prem. - [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export incidents on demand or on a schedule in Cortex XSOAR 8.10 On-prem. - [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.10 On-prem. - [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export incidents on demand to external storage in Cortex XSOAR 8.10 On-prem. - [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate incidents and take remediation steps in Cortex XSOAR 8.10 On-prem. - [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8.10 On-prem. - [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit access to incidents and investigations in Cortex XSOAR 8.10 On-prem. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage playbook and to-do incident tasks in Cortex XSOAR 8.10 On-prem. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for real-time investigations in Cortex XSOAR 8.10 On-prem. - [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8.10 On-prem. - [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run system, integration, and script commands in Cortex XSOAR 8.10 On-prem. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): Add and manage investigation evidence in Cortex XSOAR 8.10 On-prem. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Monitor and manage incident playbook workflows in Cortex XSOAR 8.10 On-prem. - [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Visually map incidents with the investigation canvas in Cortex XSOAR 8.10 On-prem. - [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents from the interface or CLI in Cortex XSOAR 8.10 On-prem. - [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8.10 On-prem. - [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Create, manage, and search indicators in Cortex XSOAR 8.10 On-prem. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8.10 On-prem without a TIM license. - [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): Create and investigate indicator relationships in Cortex XSOAR 8.10 On-prem. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence, indicators, and TIM reports in Cortex XSOAR 8.10 On-prem. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8.10 On-prem. - [Licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/licenses.md): Learn about Threat Intel Management licenses in Cortex XSOAR 8.10 On-prem. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management use cases in Cortex XSOAR 8.10 On-prem. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8.10 On-prem. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn core indicator concepts in Cortex XSOAR 8.10 On-prem. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Learn the indicator lifecycle in Cortex XSOAR 8.10 On-prem. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Learn Threat Intel Management roles in Cortex XSOAR 8.10 On-prem. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicator types, fields, layouts, and enrichment in Cortex XSOAR 8.10 On-prem. - [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicator types, fields, and layouts in Cortex XSOAR 8.10 On-prem. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Configure indicator classification and mapping in Cortex XSOAR 8.10 On-prem. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8.10 On-prem. - [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8.10 On-prem. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8.10 On-prem. - [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure Threat Intel feed integrations in Cortex XSOAR 8.10 On-prem. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8.10 On-prem. - [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure Threat Intel Management playbooks in Cortex XSOAR 8.10 On-prem. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators and configure external dynamic lists in Cortex XSOAR 8.10 On-prem. - [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Create and customize Threat Intel Reports in Cortex XSOAR 8.10 On-prem. - [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create or detach Threat Intel Report types in Cortex XSOAR 8.10 On-prem. - [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8.10 On-prem. - [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Configure Threat Intel Report layouts in Cortex XSOAR 8.10 On-prem. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Create, manage, and search indicators in Cortex XSOAR 8.10 On-prem. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators and relationships in Cortex XSOAR 8.10 On-prem. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Configure indicator verdicts in Cortex XSOAR 8.10 On-prem. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich an indicator in Cortex XSOAR 8.10 On-prem. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators from the CLI or UI in Cortex XSOAR 8.10 On-prem. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Create and manage indicator relationships in Cortex XSOAR 8.10 On-prem. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8.10 On-prem. - [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8.10 On-prem. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.