> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md). # Classification and Mapping The classification and mapping feature enables you to take the events and event information that Cortex XSOAR ingests from integrations, and classify the event as a type of Cortex XSOAR incident. For example, Cortex might generate alerts from Cortex Traps which you would classify according to the information in those events either as a dedicated Traps incident type or maybe Authentication or Malware. Also, you might have EWS configured to ingest both phishing and malware alerts which you want to classify to their respective incident types based on some information in the event. By classifying the events as different incident types, you can process them with different playbooks suited to their respective requirements. {% hint style="info" %} ### Note Classifiers and mappers can also be used for indicators. {% endhint %} **Classification** Classification determines the type of incident that is created for events ingested from a specific integration. You create a classifier and define that classifier in an integration. **Mapping** You can map the fields from your third-party integration to the fields that you defined in your incident layouts. Starting with version 6.0, mappers are separate entities from classifiers. This enables you to do the following: * Map your fields to incident types irrespective of the integration or classifier. This means that you can create a mapping before defining an instance and ingesting incidents. By doing so, when you do define an instance and apply a mapper, the incidents that come in are already mapped. * Create a default mapping for all of the fields that are common to all incident types, and then map only those fields that are specific to each incident type individually. You can still overwrite the contents of a field in the specific incident type. * Use auto-map to automatically map fields based on their naming convention. For example, severity would be mapped to importance. * Mirror content in Cortex XSOAR with third-party integrations. This enables you to make changes to an incident in Cortex XSOAR and have that change be reflected in the case managed by the integration. For example, if you are using a case management system such as JIRA or Salesforce, you can close an incident in Cortex XSOAR and have that reflected automatically.

Note

The integration must support pulling the integration schema for mirroring to work.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.