> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats.md).

# Investigate and Respond to Threats

- [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8 SaaS.
- [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Learn about incidents in Cortex XSOAR 8 SaaS.
- [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8 SaaS.
- [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search for incidents in Cortex XSOAR 8 SaaS.
- [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create incidents in Cortex XSOAR 8 SaaS.
- [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export Cortex XSOAR 8 SaaS incidents.
- [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Cortex XSOAR 8 SaaS Incidents table.
- [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate and remediate incidents in Cortex XSOAR 8 SaaS.
- [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8 SaaS.
- [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit investigation access in Cortex XSOAR 8 SaaS.
- [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage incident tasks in Cortex XSOAR 8 SaaS investigations.
- [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for Cortex XSOAR 8 SaaS investigations.
- [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run commands in the Cortex XSOAR 8 SaaS CLI.
- [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8 SaaS.
- [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/appsec-policies-migrated-with-the-new-trigger-and-finding-type-format..md): Manage investigation evidence in Cortex XSOAR 8 SaaS.
- [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Use Work Plans in Cortex XSOAR 8 SaaS investigations.
- [Add ad-hoc tasks to a Work Plan as part of your investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation/add-ad-hoc-tasks-to-a-work-plan-as-part-of-your-investigation.md): Add ad-hoc Work Plan tasks in Cortex XSOAR 8 SaaS.
- [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Investigate incidents with the Cortex XSOAR 8 SaaS canvas.
- [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents in Cortex XSOAR 8 SaaS.
- [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8 SaaS.
- [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Manage indicators in Cortex XSOAR 8 SaaS.
- [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8 SaaS.
- [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): View indicator relationships in Cortex XSOAR 8 SaaS investigations.
- [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence in Cortex XSOAR 8 SaaS.
- [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8 SaaS.
- [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management in Cortex XSOAR 8 SaaS.
- [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8 SaaS.
- [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Review Threat Intel Management roles in Cortex XSOAR 8 SaaS.
- [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn about indicators in Cortex XSOAR 8 SaaS Threat Intel Management.
- [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Learn about the indicator lifecycle in Cortex XSOAR 8 SaaS.
- [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/understand-cortex-xsoar-licenses.md): Understand licenses for Cortex XSOAR 8 SaaS.
- [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicators in Cortex XSOAR 8 SaaS Threat Intel Management.
- [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicators in Cortex XSOAR 8 SaaS.
- [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 8 SaaS.
- [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 8 SaaS.
- [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/file-indicators.md): Manage file indicators in Cortex XSOAR 8 SaaS.
- [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/formatting-scripts.md): Use indicator formatting scripts in Cortex XSOAR 8 SaaS.
- [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/enhancement-scripts.md): Use indicator enhancement scripts in Cortex XSOAR 8 SaaS.
- [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-scripts.md): Use indicator reputation scripts in Cortex XSOAR 8 SaaS.
- [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-commands.md): Run indicator reputation commands in Cortex XSOAR 8 SaaS.
- [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 8 SaaS.
- [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): Create indicator fields in Cortex XSOAR 8 SaaS.
- [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-fields-structure.md): Understand indicator field structures in Cortex XSOAR 8 SaaS.
- [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-field-trigger-scripts.md): Configure indicator field trigger scripts in Cortex XSOAR 8 SaaS.
- [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-layout-customization.md): Customize indicator layouts in Cortex XSOAR 8 SaaS.
- [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Classify and map indicators in Cortex XSOAR 8 SaaS.
- [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8 SaaS.
- [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 8 SaaS.
- [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules in Cortex XSOAR 8 SaaS.
- [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set playbook indicator extraction modes in Cortex XSOAR 8 SaaS.
- [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable indicator extraction in Cortex XSOAR 8 SaaS.
- [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): Troubleshoot indicator extraction in Cortex XSOAR 8 SaaS.
- [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8 SaaS.
- [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8 SaaS.
- [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure Threat Intel feeds in Cortex XSOAR 8 SaaS.
- [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8 SaaS.
- [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure indicator-processing playbooks in Cortex XSOAR 8 SaaS.
- [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators from Cortex XSOAR 8 SaaS.
- [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Customize Threat Intel Reports in Cortex XSOAR 8 SaaS.
- [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create Threat Intel Report types in Cortex XSOAR 8 SaaS.
- [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8 SaaS.
- [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Create Threat Intel Report layouts in Cortex XSOAR 8 SaaS.
- [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Manage indicators in Cortex XSOAR 8 SaaS Threat Intel Management.
- [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): Query indicators in Cortex XSOAR 8 SaaS.
- [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators in Cortex XSOAR 8 SaaS.
- [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Manage indicator verdicts in Cortex XSOAR 8 SaaS.
- [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators in Cortex XSOAR 8 SaaS.
- [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators in Cortex XSOAR 8 SaaS.
- [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Manage indicator relationships in Cortex XSOAR 8 SaaS.
- [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8 SaaS.
- [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8 SaaS.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.