> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/use-sessions-and-submissions-in-your-investigation.md).
# Use sessions and submissions in your investigation
The **Sessions & Submissions** tab enables you to use your firewall sessions and submissions data for investigation and analysis.
**Sessions** refer to firewall sessions that show connections from one endpoint to another. A firewall can forward information about network sessions for an investigation. Cortex XSOAR TIM uses session information to learn more about the context of the suspicious network event, indicators of compromise related to the malware, affected hosts and clients, and applications used to deliver the malware.
**Submissions** refer to sample logs reported to Wildfire from Palo Alto Networks products, such as Cortex XDR. While Sessions data shows connections from one endpoint to another, submissions data shows if a file was found on a specific endpoint.
**Sessions & Submissions** data is available for users with at least one of the following products:
* Palo Alto Networks Firewall
* WildFire
* Cortex XDR
* Prisma Cloud
* Prisma Access
You can take steps to block external IP addresses that are the sources of malicious files and threat campaigns. You can find compromised machines within your network, isolate them as needed, and take remediation steps. For example, search for a file hash in **Sessions & Submissions**. If the file appeared in one or more sessions or submissions, you can see when and where that occurred. A firewall session data enables you to view the source IP and the destination IP for each session that includes the file.
If you are using Cortex XDR, you can see which XDR agent reported the file and which computers are affected.
{% hint style="info" %}
### Note
When searching on the **Sessions & Submissions** page for relationships **`-relationships""`**, some results may appear without their specific relationships listed, due to internal relationship permissions.
(Multi-tenant) **Sessions & Submissions** data is not available for Multi-tenant deployments.
{% endhint %}
**Investigate Sessions and Submissions**
From **Sessions & Submissions** in the **ID** column click an ID to start an investigation.
In the **Session Summary** tab you can see the following information:
| Section | Description |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Basic Information | Includes general information such as the session Timestamp, destination IP, and source country. |
| Sample Information | Includes file information, such as the file name, SHA, File URL, and Status. The Status for blocked samples is Blocked, while the status for allowed samples is blank.
Note
The Application is matched to the type of application traffic detected in a session. For example, a search for the Application web-browsing returns sessions during which web browsing over HTTP occurred. See Applipedia for an updated list of applications that Palo Alto Networks identifies.