> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats.md).

# Investigate and Respond to Threats

- [Day to Day Tasks in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar.md): Manage daily Cortex XSOAR 6.14 incidents and threat indicators with investigation and response workflows.
- [Incident Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md): Open, investigate, manage, and resolve security incidents in Cortex XSOAR 6.14.
- [Create an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md): Create Cortex XSOAR 6.14 incidents manually, from feeds, or by importing JSON files.
- [Create a Search Query for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md): Create and save Cortex XSOAR 6.14 incident search queries to filter displayed results.
- [Create a Widget From an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md): Create custom Cortex XSOAR 6.14 widgets from incident search results.
- [Export an Incident to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.14 incidents to UTF-8 BOM CSV files for Cyrillic characters.
- [Incident Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): Open Cortex XSOAR 6.14 incidents to review details and investigate security events.
- [Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md): Monitor and manage Cortex XSOAR 6.14 incident playbook workflows in the Work Plan.
- [Investigate an Incident Using the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md): Visually map and investigate Cortex XSOAR 6.14 incident relationships with the investigation canvas.
- [Auto Populate the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/auto-populate-the-canvas.md): Automatically add related Cortex XSOAR 6.14 incidents and entities to an investigation canvas.
- [Dbot Suggestions: Quick View Window](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md): Review DBot incident and indicator suggestions in the Cortex XSOAR 6.14 canvas quick view.
- [Edit Dbot Incident and Indicator Suggestions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md): Configure DBot incident and indicator suggestions for Cortex XSOAR 6.14 investigations.
- [Incident Actions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md): Perform Cortex XSOAR 6.14 incident actions, including tasks, notes, reports, editing, and deletion.
- [Evidence Handling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md): Add and manage investigation evidence in the Cortex XSOAR 6.14 War Room.
- [Incident Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-tasks.md): Create and complete Cortex XSOAR 6.14 playbook and to-do tasks during investigations.
- [Link Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md): Link related Cortex XSOAR 6.14 incidents from the interface, pre-process rules, or CLI.
- [Manage Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/manage-related-incidents.md): View and manage related incidents during Cortex XSOAR 6.14 investigations.
- [Link and Unlink incidents in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/link-and-unlink-incidents-in-the-cli.md): Link and unlink related Cortex XSOAR 6.14 incidents using the command-line interface.
- [Configure Incident Fields for Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md): Configure related Cortex XSOAR 6.14 incident fields using allow and ignore list settings.
- [Indicator Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management.md): Create, search, edit, export, and manage threat indicators in Cortex XSOAR 6.14.
- [Indicator Query](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md): Search, create, edit, export, and delete threat indicators in Cortex XSOAR 6.14.
- [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/configure-the-indicator-timeline.md): Configure the Cortex XSOAR 6.14 indicator timeline and improve timeline performance.
- [Exclusion List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/exclusion-list.md): Add threat indicators to Cortex XSOAR 6.14 exclusion lists to prevent system processing.
- [Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md): Export Cortex XSOAR 6.14 threat indicators as lists or files for security tools.
- [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/manually-export-indicators.md): Manually export Cortex XSOAR 6.14 threat indicators for external security tools.
- [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-indicators-integrations.md): Export Cortex XSOAR 6.14 threat indicators through supported integrations.
- [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.14 threat indicators to UTF-8 BOM CSV files.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.