> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md). # War Room Overview Within Cortex XSOAR, real-time investigation is facilitated through the War Room, which is powered by ChatOps and helps analysts to do the following: * Run real-time security actions through the CLI, without switching consoles. * Run security playbooks, scripts and commands. * Collaborate and execute remote actions across integrated products. * Capture incident context from different sources. * Document all actions in one source. * Converse with others for joint investigations. Cortex XSOAR also provides machine learning insights to suggest the most effective analysts and command-sets. Each incident has a unique War Room. {% hint style="info" %} ### Note To access the War Room: If you have an Admin role, clicking **Playground** on the sidebar opens the **Playground - War Room** tab. If you have another role, typing any command in the CLI at the bottom of the page opens this tab. {% endhint %} When you open the War Room, you can see a number of entries such as commands, notes, evidence, tasks, etc., in several formats such as [Markdown](/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md), HTML and so on. When Markdown, HTML or geographical information is received the content is displayed in the relevant format. ![war\_room.png](/files/J6HciQzxWzHNFtEplkxA) You can do the following actions for each artifact entry. | Action | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Edit | You can edit, format or delete your own entries. If an entry has been changed, a History link will appear where you can view all changes to the entry. | | Mark as Evidence | Opens the Mark as evidence window where you specify the evidence details to be saved in the [Evidence Board](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md). The Evidence Board stores key artifacts for current and future analysis. You can add evidence in **Case Info** tab, the **Evidence Board**, or the **War Room**. | | Mark as note | Marks the incident as note. Notes can help the analyst understand why certain action was taken and assists future decisions. You can add them also in the **Case Info** tab. | | View artifact in new tab | Opens a new tab for the artifact. | | Detach from task | Removes a task from the artifact. | | Attach to a task | Adds a task to the artifact. | | Download artifact | Downloads an artifact according to the entry type, such txt files for text, json for a JSON entry, etc. | | Add tags | Add any relevant tags to use, which helps you find relevant information. | You can run various commands in the CLI, by typing the following: * **`!`**: Integration commands, automations, and built-in commands. For example, add evidence, assign an analyst, etc. * **`/`**: System commands/operations. For example, add notes, close an investigation, etc. * **`@`**: User tagging. Send notifications to administrators, teams, analysts, etc. You can edit incidents, create a report, add child incidents, and so on, as described in [Incident Actions](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md). **Filter Entities** You can filter entries by clicking ![filter.png](/files/kXBwoFWDRQgfZTJoQO2r) . You can add any filter by selecting the checkbox or click ![filter\_no.png](/files/WqtR8MUvUi6YzYI1v8EY) to remove that action. The filter menu contains three types of War Room entities by which you can filter: * Actions * Tags * From Use the And/Or toggles between the Actions, Tags and From sections. * And: Use to combine two or more filters. * Or: When one item is found it shows relevant entries. You can save the filter by clicking **Add**. You can also retrieve **Saved filters**. To share a saved filter, click the share icon for the saved filter in the dropdown. You can share the filter with all roles or with specific roles. **Entry IDs** Entry IDs are used to uniquely identify War Room entries in Cortex XSOAR. Entry IDs take the format `@`, for example, `54925dc3-a972-4489-8bef-793331fa6c77@1`. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. To find the entry ID of an entry in the War Room, click on the vertical ellipsis icon at the upper right of the entry, then copy the ID value. ![entryid.png](/files/VdCt47ND11oUTGespB9m) **Indicator Notifications** You can disable War Room notifications for related indicators. Go to Settings → About → **Troubleshooting** and add the following server configuration: | Key | Value | | ------------------------------- | ----- | | create.related.indicators.entry | false | {% hint style="info" %} ### Note Cortex XSOAR does not index notes, chats, and pinned as evidence entries. If you want to index these entries, see [War Room Indexing](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.