Note
If the incident ID hyperlink is unavailable, the incident was closed before the investigation started, usually through a preprocess rule or it was already closed when fetched. If you want to see the incident details, click Summary View at the top of the incidents table.
After an incident is created, it is assigned a Pending status in the incident table. When you start to investigate an incident the status changes automatically to Active, which starts the remediation process.
A summary of the incident, such as case details, work plan, evidence, and so on. Most of the fields are for information only, although you can add the following:
- Evidence: A summary of data marked as evidence. You can add evidence in this tab or in the Evidence Board.
Notes: Displays any notes that have been entered. For example, understand specific actions taken by the analyst and the underlying reasons, see chats between analysts to highlight how they arrived at a certain decision, etc. You can also see the thought process behind identifying key evidence and learn about similar incidents in the future.
You can also add notes in the War Room.
- Tasks: View tasks to complete as part of an investigation. You can add tasks in this tab or Create a To-Do Task.
You can send a permalink to a specific Investigation Summary by copying its URL.
|
| **Investigation** | An overview of the information collected about the investigation, such as indicators, email information, URL screen shots and so on |
| [War Room](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md) | A comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the incident investigation. Each incident has a unique War Room. |
| [Work Plan](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md) | A visual representation of the running playbook that is assigned to the incident. |
| [Evidence Handling](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md) | View any entity which has been designated as evidence. The Evidence board stores key artifacts for current and future analysis. You can reconstruct attack chains and piece together key pieces of verification for root cause discovery. |
| [Related Incidents](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md) | A visual representation of incidents that share similar characteristics, such as malicious indicators, or part of a phishing campaign. |
| [Canvas](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md) | Visually maps an incident, its elements, correlated investigation entities, and the progression path of the incident, combining analyst intelligence with machine learning.
The Related Incidents page is orientated towards exploration and searching for similar data. The Canvas maps incidents and indicators by enabling you to decide what you want to include in a layout of your choice.
|
You can [link incidents](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md), edit the incident, add a child incident, add tasks, notes, and so on. For more information, see [incident actions](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md).
**Inline Value Fields**
By default, when editing the following inline values in an incident, the changes are not saved until you confirm your changes (clicking the checkmark icon in the value field).
* Dropdown values, such as Owner, Severity, etc.
* Text values, such as Asset ID. (You can only edit when you click the pencil in the value field).
These icons are designed to let you have an additional level of security before you make changes to the fields in incidents, indicators, and threat intel reports.
To change the default behavior set the **`inline.edit.on.blur`** server configuration to **`true`**, which enables you to make changes to inline fields without clicking the checkmark. The changes are automatically saved when clicking anywhere on the page or when navigating to another page. For text values you can also click anywhere in the value field to edit.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.