> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/detect-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md). # Evidence Handling While you're investigating an incident, you can add notes and evidence to assist you with your investigation. Notes can help you understand why certain actions were taken and assist future decisions. Notes are highlighted, so you can easily find them, especially in the War Room. When marking an artifact as evidence, these artifacts are added to the **Evidence Board** tab, which enables you to see all artifacts for current and future analysis in a single location. {% hint style="info" %} ### Note You can change a note to evidence or vice-versa and have the same entry as a note and evidence. {% endhint %} **How to add evidence** You can add evidence by doing the following: | Action | Description | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | War Room Entry |

In a War Room entry, click Mark as Evidence.

Add a description that should contain enough information, so it can be used for future reference. Adding a tag helps you to find the evidence by searching for the tag. You can also add a time and date when it occurred.

When adding a time/date you need to save it before updating the evidence.

| | Upload a file |

Upload a file to the War Room by selecting Mark as Evidence.

Important

Make sure files uploaded as attachments to the War Room are smaller than 250 MB. Uploading larger files can affect performance.

| | Using the CLI |

Run the !AddEvidence entryIDs=\`\`ID of the war room entry command.

In the relevant War Room entry, click Copy to CLI to retrieve the ID of the War Room entry.

| | Playbook task | In a Playbook task (Advanced tab). Tasks can be automatically added as evidence from script outputs. | | Case Info tab |

If the Case Info tab includes an EVIDENCE section, you can add it to the section.

Whenever you add evidence, this appears in both the Evidence Board tab and the EVIDENCE section in your layout.

| **Evidence Board** The **Evidence Board** tab shows all the entries marked as evidence for current and future analysis. Typically you can use the **Evidence Board** to do the following: * Reconstruct attack chains * Piece together key pieces of verification for root cause discovery * Construct a timeline of events that can further clarify your incident response * Use it for audit reports and compliance requirements to show how you reached a decision. You can search for evidence and select the date range when the evidence occurred. When viewing an Evidence artifact you can see the following fields: * **occurred**: The time/date that you added when the artifact occurred. For example, when the file was created. If no time/date is specified it is marked as Unknown. * **fetched**: The time/date when the entry was created in Cortex XSOAR. * **markedDate**: The time/date when you marked it as evidence. * **MarkedBy** The user who marked it as evidence. * Any Evidence fields you have added to the tab. You can also edit or remove evidence from the Evidence Board. {% hint style="info" %} ### Note Adding tags to evidence from the Evidence Board does not create the same tags in the War Room. {% endhint %} Use the toggle button ![toggle-evidence.png](/files/f0yUdX1rY3XOeApskewh) to switch between **Table View** or **Summary View**. In the **Table View**, you can remove, export, or show evidence in the **War Room**. In the **Summary View** you can remove or edit the evidence. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/detect-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.