> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/investigation-and-response.md).

# Investigation and response

Investigation and response in Cortex Data Security provides a specialized toolset for uncovering and neutralizing risks to your sensitive data. Unlike traditional security workflows that focus on malware or host forensics, Cortex Data Security investigation is focused on the relationship between identities, cloud infrastructure, and data sensitivity. By understanding the "blast radius" of a potential threat, you can prioritize remediation for assets that contain your most critical information, such as PII or proprietary code.

## Powering investigations with the Marketplace

Before you can effectively investigate your data environment, you must first enable the necessary integrations and automated workflows via the Marketplace. The Marketplace is a centralized content portal that lets you discover, install, and manage content packs in Cortex Cloud.

These packs support specific security orchestration use cases by bundling together the integrations, playbooks, scripts, and dashboards required to:

* **Discover assets**: Connect to cloud providers (AWS, Azure, GCP) to feed data into your Asset Graph.
* **Remediate risks**: Install pre-built playbooks to automate responses, such as notifying data owners via Slack or opening Jira tickets.

{% hint style="info" icon="note-sticky" %}
**Note:** For more information on discovering and managing content packs, see the [Cortex Cloud Marketplace documentation](/cortex-cloud-runtime-security/marketplace/cortex-marketplace.md).
{% endhint %}

## Investigation and response tools

Once your environment is configured, you can use the following components to investigate and resolve data risks:

* **Investigate issues**: The central hub for reviewing data-security-specific violations, such as misconfigured storage buckets or exposed databases.
* **Graph Search (Asset Graph)**: A visual tool to map the connections between identities and data, revealing the "attack paths" to sensitive assets.
* **Asset investigation**: Detailed "Asset Cards" that provide sensitivity levels, exposure status, and security history for any data resource.
* **Cortex Assistant**: A natural-language interface for asking complex questions like, "Which internet-exposed S3 buckets contain sensitive PII?"
* **Automation and playbooks**: Pre-built workflows to notify data owners or automatically revoke excessive permissions.
* **XQL queries**: Advanced granular searches across specialized Cortex Data Security datasets like `ds_inventory` and `ds_findings`.

## Examples of investigation and response

* **Remediating data exposure**: Identifying an exposed production database and using the Action Center to immediately modify its resource policy.
* **Identity risk assessment**: Using Graph Search to identify all sensitive data assets accessible to a high-risk or compromised cloud user.

{% hint style="info" icon="note-sticky" %}
**Note:** For more information on these shared platform tools, see the [Cortex Cloud Investigation and response documentation](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/investigation-and-response.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.