If the incident ID hyperlink is unavailable, the incident was closed before the investigation started, usually through a preprocess rule or it was already closed when fetched. If you want to see the incident details, click the Switch to detailed view icon at the top of the incidents page.
After an incident is created, it is assigned a Pending status. When you start to investigate an incident the status changes automatically to Active, which starts the remediation process.
A summary of the incident, such as case details, outstanding tasks, linked incidents, and evidence. Some fields are informational and some are editable. Includes the following sections (depending on the layout):
WORK PLAN When you click on the section, you can view or take action on the following:
To-Do Tasks View or create To-Do tasks.
You can also create To-Do Tasks from the Actions tab. See Incident Tasks.
NOTES: If added to the layout, notes help you understand specific actions taken, and allow you to view conversations between analysts to see how they arrived at a certain decision. You can see the thought process behind identifying key evidence and identifying similar incidents.
You can add notes in this section or in the War Room. Notes are searchable when using the incidents search bar.
Add or delete incident team members.
Note
When you mention team members in the CLI, they are automatically added as team members.
View context data to see what information was returned. The context is a map (dictionary) created for each incident and is used to store structured results from the integration commands and scripts. Context keys are strings and the values can be strings, numbers, objects, and arrays.
Context data acts as an incident data dump from which data is mapped into incident fields. When an incident is generated in Cortex XSOAR and a playbook or analyst begins investigating it, context data will be written to the incident to assist with the investigation and remediation process.
Note
All incident data stored in incident fields are also stored in the context data. In most cases, not all context data is stored in incident fields. Incident fields represent a subset of the total incident data.
When an incident is created, the incident data is stored in the context data, under the incident key. When an investigation is opened and integration commands are run, data returned from those commands is also stored outside of the main incident key.
For more information, see Use incident context data.
| When viewing an incident, from the **Actions** dropdown, you can do the following: | Action | Description | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Edit | Edit the incident, as required. | | Report | Create a report to capture investigation-specific data and share it with team members. For more information, see [Create an incident summary report](/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md). | | Add a child incident |Child investigations are used to compartmentalize sensitive War Room activity. You can create child investigations to collaborate discreetly with a select group of people on a specific topic of investigation. Child investigations are also used where a secondary investigation is needed and its content may add too much "noise" to the original investigation.
Select the Restricted checkbox to turn the child investigation into a discrete investigation.
| | Restrict/Permit an incident | Restrict an investigation for the incident owner and team. If restricted, select permit to open the incident to all users. For more information, see [Limit access to investigations using access control](/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md). | | Close/Reopen an incident |Mark the incident as closed. If closed, you can select Reopen the incident.
When you close an incident, the close reason is set to whatever value you last entered. For example, when closing an incident, if you initially selected False Positive as the Close Reason, reopened it, and closed it again, leaving the Close Reason empty, the empty Close Reason will overwrite the previous Close Reason. To keep the close reason that was entered previously on the incident, add the previous value in the Close Reason argument.
| | Retain/Undo Retain an incident | Mark the incident for retention or disable retention for the incident. For more information, see [Retain incidents](/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md). | | Delete | Delete the incident from the database. |