> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md).
# Create an incident
Create incidents in Cortex XSOAR 8.13 On-prem.
You can create incidents in Cortex XSOAR from:
* The **Incidents** page
* An indicator
* A JSON file (primarily used for playbook testing)
* The API
To create a single incident using the API, use `/xsoar/public/v1/incident` . If you create an incident via the API and do not set `createInvestigation: true`, the incident is created, but an investigation will not be opened and a playbook will not automatically run. For more information, see [Create or update an incident](/xsoar-8-api/cortex-xsoar-8.x-apis/incidents.md#create-or-update-an-incident). You can also create a single incident from raw JSON using `/xsoar/public/v1/incident/json`.
To view the full API documentation, go to [Cortex XSOAR 8 API Reference guide](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/).
* Integration feeds
Incidents can be created from an integration instance. For more information about how to fetch incidents, see [Fetch incidents from an integration instance](/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md).
{% hint style="info" %}
### Note
If you can't create an incident from any of these options, you may not have sufficient user role permissions. Contact your Cortex XSOAR administrator for more details.
{% endhint %}
Create an incident on the Incidents page
To manually create an incident:
1. Select **Incidents** → **New Incident**.
2. Add the relevant data as required.
3. **Create new incident**.
The incident is added to the incidents table.
{% hint style="info" %}
### Note
If any fields are missing, these fields can be added when configuring a layout.
You need administrator permission to configure a layout. For more information, see [Incident layout customization](/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md).
{% endhint %}
Create an incident from an indicator
1. In the **Indicators tab**, select the indicator.
2. Click **Create incident**.
The incident appears in the incidents table on the **Incidents** page.
Create an incident from a JSON file
The import JSON feature enables you to import event data from third-party software and use it to create new incidents in Cortex XSOAR. These incidents can be used to build and troubleshoot playbooks for integrations that have not yet been installed or configured.
1. Go to Settings & Info → Settings → Object Setup → Incidents → **Classification & Mapping** and click the mapper you want to use.
2. From the **Get Data** drop-down, choose **Upload JSON** and then select the JSON file you want to upload.
3. Map the fields as required. For more information, see [Classification and mapping](/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md).
4. Click  and select **Create Incident from JSON**.
5. Select the incident type and **Create Incident**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.