> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md).

# Incident Tasks

Incident tasks are tasks for users to complete as part of an investigation, which is split according to the following:

| Task          | Description                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Playbook task | <p>A task that is part of the <strong>Work Plan</strong> (playbook) for an incident. When a playbook runs you can take action on any tasks that require attention in the Work Plan, such as assigning an owner, setting a due date, and completing the task. These tasks include the following subtypes:</p><ul><li>Automated tasks</li><li>Manual tasks</li><li>Manual conditional tasks</li><li>Data collection tasks</li></ul> |
| To-Do tasks   | An ad-hoc item that is not attached to the incident Work Plan. Create tasks for users to complete as part of an investigation. These are like a To-Do list that you keep in an investigation on an ad-hoc basis rather than the Work Plan which follows a pre-defined process.                                                                                                                                                    |

{% hint style="info" %}

### Note

You can close an incident even if there are open playbook tasks or open To-Do tasks.
{% endhint %}

You can view outstanding tasks in the **INCIDENT TASKS** pane, by clicking **Side panels** → **Incident Tasks**.

{% hint style="info" %}

### Note

You can also access the **INCIDENT TASKS** pane from the **Case Info** tab, in the **WORK PLAN** section, or the **TO-DO TASKS** section if it has been added to the layout.
{% endhint %}

How to create a To-Do task

1. In the incident, click **Side panels** and then select **Incident Tasks**.
2. In the **INCIDENT TASKS** pane, click the **To-Do Tasks** tab.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If your <strong>Case Info</strong> tab in the incident layout includes a <strong>TO-DO TASKS</strong> section or has a <strong>WORK PLAN</strong> section you can access the <strong>INCIDENT TASKS</strong> section directly.</p></div>
3. Click **Add a task**.
4. Add the **Task Details** as required:

   | Parameter           | Description                                                                                                                                 |
   | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
   | Task Name           | A meaningful name for the task (mandatory).                                                                                                 |
   | Task Description    | A meaningful description of the task that provides sufficient information for the assignee to complete the task.                            |
   | Assignee            | The user to assign to the task. You can only assign a single user per task.                                                                 |
   | Set due date        | The due date for the task. If the task is not completed by this date, it is marked as overdue but is not a roadblock for the investigation. |
   | Tag the result with | Tags to apply to the to-do task, so you can easily find it in the War Room.                                                                 |
5. Save the task.

{% hint style="info" %}

### Tip

Use the `!MyToDoTasksWidget` command in the CLI to see all your assigned tasks in the War Room. You can also use the `!Todo` command to manage the task, such as add, assign, and complete.

When you are added to a task, you receive a notification by email. To turn this on or off, go to **\<your name** → **User Preferences** → **Notifications** and select the relevant section.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.