> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md).

# Create an incident classifier

When an integration fetches incidents, it populates the raw JSON object in the incident object. The raw JSON object contains all of the attributes for the event, such as the source of the event and when the event was created. When classifying the event, select an attribute that can determine the event type.

When creating a classifier, you can pull data from the following:

* An existing integration instance

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Ensure that your instance is configured and enabled but you don't need to fetch incidents.</p></div>
* Schema

  When supported by the integration, this pulls all of the integration fields from the database. You select from these fields to classify the events.
* Upload a JSON file

  Upload a formatted JSON file which includes the field you want to classify. If the instance has nothing to fetch or has insufficient data, you can upload a JSON file containing raw data.

1. Go to Settings & Info → Settings → Object Setup → Incidents → **Classification & Mapping**.
2. Do one of the following:
   1. To create a new classifier, select **New** → **Incident Classifier**.
   2. To edit an existing classifier open the classifier.

      If the classifier is installed from a content pack, you need to duplicate and then open it.
3. Enter a name for the classifier so it can be easily identified.
4. Under **Get data**, select from where you want to pull the event data. You will classify the incident types based on this information.
   * Pull from instance
   * Select schema
   * Upload JSON
5. Under **Select Instance**, select the integration instance from where you want to pull data.

   In the **Data fetched from \[name of integration instance)** section, you will see the raw alert data pulled in from the integration instance. In this example, after configuring the **Sample Incident Generator** instance, we have pulled in the following data:

   ![classifier-data-fetched.png](/files/YRKAsbvaCIxDX03Lqtog)
6. To route the alert information to an incident type, select the classification key,
   1. In the **Data fetched** section, click the key you want to map. For example, `type`.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Tip</h3><p>Select a key that is common to across all the samples. If a key is selected that will change across all alerts such as <code>SourceIP</code> there could be many values.</p></div>

      In the **Unmapped Values** section, the selected key returns any unmapped classifier values. For example, `type` returns `Malware`, `Unclassified`, and `Phishing`.

      ![classifier-unmapped.png](/files/LYi1ActlMx51svwaBVc0)
   2. Drag and drop the unmapped classifier values onto the **Incident Types** section.

      For example, you can see the `Malware` and `Phishing` values have been mapped to the relevant incident type.

      ![classifier-mapped.png](/files/AU1UBGD6SlLmpdSRDLfi)
   3. In the **Direct Unclassified events to** field, select the incident type for unclassified events.

      If you don't choose a default incident type, the classifier uses the default incident type, which is set to the **Unclassified** incident type. To view the default incident type, go to the **Incidents** page and add the **Default** column. You can set a different default incident type as required.
   4. (Optional) If there are events that haven't been pulled from the samples you can manually add them to the **Incident Types** section, by clicking the edit button in the **Incident Type** field. For example, if you know that the source has a `file blocked` incident type, click the edit button on the relevant field and type `file blocked`.
7. Save the classifier.
8. (Optional) Create a mapper, if required.
9. Go to Settings & Info → Settings → Integrations → **Instances**.
   1. Select the integration from which you want to apply the classifier.
   2. In the integration settings, under **Classifier**, select the classifier you created and click **Done**.

      For some instance integrations, you need to click **Fetches incidents** to add a classifier and mapper.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.