> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md). # Incident Management Incidents are events that have been observed at a point in time and saved for analysis. Incidents can be ingested from third-party integrations, created manually through the user interface, or generated through the REST API. {% hint style="info" %} ### Note To view the REST API documentation, select Settings → INTEGRATIONS → API Keys → **View Cortex XSOAR API**. {% endhint %} In the **Incidents** page, you can view all of the incidents in Cortex XSOAR: * You can view general information about each incident, such as the type, the severity, when it occurred, etc. The status of the incident is classified as follows: **Active**: The investigation has started. The War Room is activated and the Playbook starts, if assigned. Users can be assigned to this incident. **Pending**: The investigation has not started and no War Room has been activated. As soon as you open the incident, it becomes active. **Closed**: The investigation has been closed. * By default, the **Incidents** page displays all open incidents from the last seven days. You can update this by creating a new [search query](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md). You can also [Create a Widget From an Incident](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md), based on the search query and add it to a dashboard or report. * Incident type, severity, owner, etc. are displayed in bar charts. You can change these by selecting a different chart from the dropdown list at the top of each individual chart. You can also hide the chart panel. You can limit access to investigations and restrict investigations according to your requirements, as described in [Incident Access Control Configuration](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration.md). When you select an incident, you can do the following: * [Investigate an incident](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): You can view a detailed summary, investigate, add evidence, see related incidents, etc. * **Assign**: You can assign incidents to any user that has been added to Cortex XSOAR, including those users who are marked as away. * **Edit**: You can edit the incident parameters and then rerun a playbook on the incident, which is useful while developing playbooks. You can process an incident multiple times during playbook development, without creating new incidents every time.

Note

When batch editing multiple incidents, uploading files is currently not supported.

* **Mark as Duplicate** * **Run Command** * **Export** to a CSV file. By default, the CSV file is generated in UTF8 format. You can change this to the [UTF8-BOM format](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md). To export an incident as a JSON file, run the **`!js script="return ${.}"`** command in the War Room, * **Close** the incident When you close an incident, the close reason is set to whatever value you last entered. For example, when closing an incident, if you initially select **False Positive** as the **Close Reason**, reopen it, and close it again, leaving the **Close Reason** empty, the empty **Close Reason** will overwrite the previous **Close Reason**. Add the previous value in the Close Reason argument to keep the close reason that was entered on the incident.

Note

Changes can be made to a closed incident from the Incident's page without reopening the incident. If you want to prevent users from making any changes to incident fields, after the incident it is closed, set the incident.prevent.modify.closed server configuration to true (Admin users can still modify an incident after it is closed).

* **Delete** the incident In addition, you can select multiple incidents and run a command across all of them. You can also delete or export batches of incidents or mark multiple incidents as duplicate. You can create a new incident by clicking **New Incident**. You can also create a new incident in the REST API. You can filter the incidents that are ingested into Cortex XSOAR by [manually de-duplicating incidents](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md#UUID-4df07e5e-08bb-1348-938d-1e9ac018da75), setting up [pre-process rules](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md#UUID-e49e2cac-8f6f-17d7-51fc-b69b438ccd7c) to perform certain actions, or [automatically de-duplicating incidents](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md#UUID-f47fef00-753a-54d3-b6e3-b89201fa9c68). After you close an incident you may want to automate an additional action such as closing a Remedy ticket. For more information, see [Post Processing for Incidents](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents.md). Incidents can be assigned a severity - either at incident creation, manually, through the CLI, or by running a playbook. Incident severity levels are: * Unknown (0) * Informational (0.5) * Low (1) * Medium (2) * High (3) * Critical (4) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.