> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md).

# Manage main tenant users in an investigation

Users can be added to the incident investigation in the child tenant from the main tenant or from the child tenant directly. When viewing a list of users, they are separated according to users and child tenant users.

{% hint style="info" %}

### Note

You will see a list of users, separated according to **USERS** and **MAIN TENANT USERS**. If you access the child tenant directly and not via the main tenant, you are considered a child tenant user (under **USERS**).
{% endhint %}

You can add main and child tenant users to the investigation and in other places, which gives a holistic bilateral communication experience between the main and child tenants. You can do the following:

* Add team members to the investigation

  Click **Side panels** and select **Team**.
* Change the incident owner
* Update tasks

  You can change the To-do tasks assignee or change the owner when completing a task.
* Change the owner in Quick View

  Go to **Side panels** → **Quick View** → **Owner**.
* Update a task in the Work Plan
* Add a user in the CLI

  When you type the user's name you can see whether they are from the main or child tenant. The user receives a system email to investigate.
* Add users in the War Room

  When mentioning a user in the War Room, the user receives a system email regardless of whether they are a child or main tenant user.

In the **Actions** tab, you can copy the incident URL in the main/child tenant, so users can directly link to the main/child tenant. For example, when accessing the incident from the main tenant, you may want an end-user's input into the incident you are investigating. Copy the URL and send it to the user via email or Slack. The user opens the link and can start investigating.

For the full range of investigation options, see [Investigate an incident](/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md).

{% hint style="info" %}

### Note

Depending on where the link is copied from, users access the link either in the child tenant directly or from the child tenant via the main tenant.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.