> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md).
# Create an incident
You can create incidents in Cortex XSOAR from:
* The **Incidents** page
* An indicator
* A JSON file (primarily used for playbook testing)
* The API
To create a single incident using the API, use `/xsoar/public/v1/incident` . If you create an incident via the API and do not set `createInvestigation: true`, the incident is created but an investigation will not be opened and a playbook will not automatically run. For more information, see [Create or update an incident](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Create-or-update-an-incident). You can also create a single incident from raw JSON using `/xsoar/public/v1/incident/json`.
To view the full API documentation, see the [Cortex XSOAR 8 API Reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/cortex-xsoar-api).
* Integration feeds
Incidents can be created from an integration instance. For more information about how to fetch incidents, see [Fetch incidents from an integration instance](/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md).
{% hint style="info" %}
### Note
If you can't create an incident from any of these options, you may not have sufficient user role permissions. Contact your Cortex XSOAR administrator for more details.
{% endhint %}
Create an incident on the Incidents page
To manually create an incident:
1. Select **Incidents** → **New Incident**.
2. Add the relevant data as required.
3. **Create new incident**.
The incident is added to the incidents table.
{% hint style="info" %}
### Note
If any fields are missing, these fields can be added when configuring a layout.
You need administrator permission to configure a layout. For more information, see [Incident layout customization](/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md).
{% endhint %}
Create an incident from an indicator
1. In the **Indicators tab**, select the indicator.
2. Click **Create incident**.
The incident appears in the incidents table on the **Incidents** page.
Create an incident from a JSON file
The import JSON feature enables you to import event data from third-party software and use it to create new incidents in Cortex XSOAR. These incidents can be used to build and troubleshoot playbooks for integrations that have not yet been installed or configured.
1. Go to Settings & Info → Settings → Object Setup → Incidents → **Classification & Mapping** and click the mapper you want to use.
2. From the **Get Data** drop-down, choose **Upload JSON** and then select the JSON file you want to upload.
3. Map the fields as required. For more information, see [Classification and mapping](/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md).
4. Click  and select **Create Incident from JSON**.
5. Select the incident type and **Create Incident**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.