> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md). # Link Incidents You can link or unlink incidents through the following: * In the [Related Incidents](#manage-related-incidents) tab. * A [pre-process rule](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md), so that as soon as an incident is ingested into Cortex XSOAR it is linked to an existing incident. * Using the [CLI](#link-and-unlink-incidents-in-the-cli). After you link the incident, you can view linked incidents in the **Case Info** tab. ![linked-incident.png](/files/cVyjXIurItU3g9oymLn5) ### **Manage Related Incidents** Related incidents are determined by calculating a similarity score based on how many identical indicators the incidents share per indicator type (Email, File, IP, URL, or other indicator type) and how many key-value pairs are identical within incident labels and custom fields. If incident A does not have any IP indicators, but incident B does have IP indicators, the similarity is calculated as 0 for this axis. If neither incident has IP indicators, IP indicators are not used as part of the similarity calculation. The related incidents map provides a visual representation of incidents that share similar characteristics, such as malicious indicators, or that are part of a single phishing campaign. Viewing related incidents in a single view enables you to consolidate the investigation by deduplicating and linking related incidents to the incident you are viewing. Linking incidents helps you assess whether the action taken is effective. **Using the Related Incidents Map** Go to the incident that you are investigating and click **Related Incidents**. ![related\_incidents.png](/files/A1Oaf49TWK6IXASYJkAr) **Understanding the Related Incidents Map** * The incident you are currently investigating is at the center of the Related Incidents map, surrounded by the related incidents. The more similar a related incident, the closer it is to the center. * The incidents are categorized according to incident status (pending, active, and closed) and type (such as malware, phishing, and so on). In this example, phishing is categorized: | Shape | Status | | ----------------------------------------------------- | -------------- | | ![incident\_pending.png](/files/e5YDbCH9YHaNEUwwREOj) | Pending status | | ![incident\_active.png](/files/JqOpUybUGgKYEs2G1rZm) | Active status | | ![incident\_closed.png](/files/Tp07PWp6v95NT18g63Sv) | Closed status | * The map has a time spectrum. Incidents on the right side of the map are newer than the current incident, and the incidents on the left are older. Related incidents are spread across the spectrum according to the time the incident was created. The time scope is 30 days before and 30 days after the currently investigated incident. You can modify the range by using the **Date Range**. * Use the **Similarity Scale** to display related incidents that are more similar or less similar to the current incident. * Hover over a related incident to view detailed information. * Click an incident to view a comparison of the two incidents, which shows instances of similar indicators between the incidents. You can click multiple incidents by using **`ctrl + click`** or **`command + click`**. In the **Similarities** window, you can pair as **Linked** or as **Duplicate**. The incident appears as linked in the **Linked Incidents** table in the **Case info** tab. If you want to build your own related incidents and indicators a layout of your choice, use the [Canvas](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md). The **Related Incidents** page is orientated towards exploration and searching for similar data. You can configure an allow list or an ignore list for which incident fields to use for related incidents, as described in [Configure Incident Fields for Related Incidents](/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md). ### **Link and Unlink incidents in the CLI** You can link and unlink incidents in the CLI. The linked incidents appear in the **Case Info** tab. 1. To link an incident, in the CLI, type the following command: **`!linkIncidents linkedIncidentIDs=`*****``*****` `` ``action=link `** Confirmation of the linked incident appears in the War Room and in the **Case Info** tab. In this example, we have linked the incident ID#3. ![linked-incident-war.png](/files/DafulwlIMuVcj77PlKfg) ![linked-incident-3.png](/files/crOTb1KoUF511pChseEb) 2. To unlink the incident, type the following command: **`!linkIncidents linkedIncidentIDs=`*****``*****` `` ``action=unlink `** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.