> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/cases-and-issues.md).

# Cases and issues

Cases and issues provide a structured framework for managing and resolving security risks discovered across your data ecosystem. An issue represents a specific policy violation or security finding—such as a publicly exposed S3 bucket or an over-privileged identity with access to sensitive PII. A case acts as an investigation container that aggregates related issues and findings into a single contextual story, allowing your team to remediate the root cause of a data risk rather than treating individual alerts in isolation.

Examples of Cortex Data Security cases and issues:

* **Sensitive data exposure**: A case grouping multiple issues where "Top Urgent" assets, such as production databases containing PCI data, are found to be internet-exposed.
* **Excessive data permissions**: An issue identifying a SaaS user or cloud identity with administrative entitlements that have been unused for over 90 days, increasing the risk of account takeover.
* **Infrastructure drift**: An issue detecting a configuration change in a cloud disk or storage bucket that deviates from your organization's security baseline.

## Finding cases and issues

In Cortex Data Security, you can use the **Cases and Issues** pages to see lists of all cases and issues,track remediation progress, assign owners, and utilize automated playbooks to streamline your response to data-centric threats.

There are also other ways to navigate to cases and issues:

* The Data Security Command Center, Data Security dashboard, AI Security dashboard, and Identity Security dashboard all report on their respective issues. Clicking on the issues in these dashboards will direct you to the **Issues** page with the appropriate filters in place.
* When investigating an asset, you can see any issues associated with it and click to navigate to those issues.
* When investigating issues you can see their associated case and click to navigate to that case.

The following example flows show how you might navigate to cases and issues in your workflows:

### Example flow 1: Investigating an asset

1. While viewing your data assets on the **Data Assets** page, you see that an S3 bucket has an open issue.
2. You click on the asset to see more details, then click on the issue to investigate.
3. In the issue card's **Overview** tab, you see a description of the issue. It explains that the bucket has enabled data flow to an external location, which can compromise confidentiality, data sovereignty, and regulatory compliance.
4. You click on the **Resolution** tab and see that the recommended action is to edit the replication rule to prevent the external fow of data.
5. You click on the action to see the more details, and follow the steps provided to resolve the issue.

### Example flow 2: Investigating a case

1. While viewing the **Data Security Command Center**, you see several active threats in your environment, displayed as open cases under **DDR**.
2. You click on a high-severity issue, as an anomalous data download, to investigate.
3. In the issue details, you see it is associated with a broader case titled "Anomalous Data Download by Compromised User." You click on the case to investigate the full incident.
4. In the cases overview, the AI summary explains the complete attack narrative. You review the list of associated issues and see that the platform has linked multiple distinct alerts together: an initial login from an unusual location, a subsequent suspicious role change, and finally the excessive data download. This allows you to easily trace the full path of the compromise.
5. You navigate to each issue, click on the **Resolution** tab, and follow the recommended actions to contain the threat.

{% hint style="info" icon="note-sticky" %}
**Note:** For more information about cases and issues, see the [Cortex Cloud Cases and issues documentation](/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/cases-and-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.