> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/classify-events-using-a-classification-key.md).

# Classify Events Using a Classification Key

Classify events with a classification key in Cortex XSOAR 6.14.

When an integration fetches incidents, it populates the rawJSON object in the incident object. The rawJSON object contains all of the attributes for the event. For example, source, when the event was created, the priority that was designated by the integration, and more. When classifying the event, you want to select an attribute that can determine what the event type is.

{% hint style="info" %}

### Note

You can also configure classifiers for indicators, by going to **Settings** → **OBJECTS SETUP** → **Indicators** → **Classification & Mapping** .
{% endhint %}

1. Go to Settings → OBJECTS SETUP → Incidents → **Classification & Mapping**.
2. Click **New** and select **Incident Classifier**.
3. Under **Get data**, select from where you want to pull the information based on which you will classify the incident types.
   * Pull from instance - select an existing integration instance.
   * Select schema - when supported by the integration, this will pull all of the fields for the integration from the database from which you can select by which to classify the events.
   * Upload JSON - upload a formatted JSON file which includes the field by which you want to classify.
4. Under **Select Instance**, select the instance from where you want to choose the value.
5. Under **Fetched data** select the value by which you want to classify the events.
6. Drag values from the **Unmapped Values** column to the relevant incident type on the right.

   You can optionally choose a default incident type for unclassified incidents from **Direct unclassified events to: Select**.

   ![classify\_incidents.png](https://3548014557-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOHlpKeFtqCLUYKuYyccd%2Fuploads%2Fgit-blob-c8138ce2c982682809bcbb2862cd1abf8d388600%2F59dd7fa72bc103e1fbb333e1c0aa42148dc6f6b9457dc9969cfca944da85a1ce.png?alt=media)

   If you do not choose a default incident type, the classifier will use the "default" incident type for unclassified incidents. The default incident type can be configured on the Incident Types page, and is set to "Unclassified" by default.
7. Click **Save**.
8. Go to Settings → INTEGRATIONS → **Instances**.
   1. Select the integration to which you want to apply the classifier.
   2. In the integration settings, under **Classifier**, select the classifier you created and click **Done**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/classify-events-using-a-classification-key.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.