> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md).

# Create an Incident

Create Cortex XSOAR 6.15 incidents manually, from feeds, or by importing JSON files.

Cortex XSOAR incidents can be created manually, from a JSON file, from the Cortex XSOAR RESTful API, or from an integration feed.

{% hint style="info" %}
The import JSON feature enables you to import event data from third-party software and use it to create new incidents in Cortex XSOAR. These incidents can be used to build and troubleshoot playbooks for integrations that have not yet been installed or configured.
{% endhint %}

* Create an incident manually.

  Go to the **Incidents** page, click **New Incident** and enter relevant data, including custom fields if needed.
* Create an incident from a JSON file.

  1. Go to Settings → OBJECTS SETUP → Incidents → **Classification & Mapping** and click the mapper you want to use.
  2. From the **Get Data** drop-down, choose **Upload JSON**, click on the paper clip icon and upload the JSON file.
  3. [Map the fields](/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md#UUID-13cf1a59-bf55-d030-618c-f0457b202c67_id2794d8a6-02ae-4cde-92a8-9eae712fd2cf).
  4. From the <img src="https://content.gitbook.com/content/8xEMUKpU65o1wagTHaO3/blobs/L8bRKevVcDn8y09glN67/c2d9fb95eec28f7839bd5d30fecd165bc5a7db57b1e47b19bbb53bade9bce039.png" alt="market-gear.png" data-size="line">menu, select **Create Incident from JSON**. Select the incident type and **Create Incident**.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>To export an incident to a JSON file, run the <strong><code>!js script="return ${.}"</code></strong> command in the War Room. You can then import the JSON file, for example, in a development environment for mapping and testing.</p></div>
* Create an incident via the API.

  To view the full REST API documentation, select Settings → INTEGRATIONS → API Keys → **View Cortex XSOAR API**. To create a single incident via the API, use the /incident route. If you create an incident via the API and do not set **createInvestigation** to true, the incident will be created, but an investigation will not be opened, and a playbook will not automatically run. To create multiple incidents, use /incident/batch. The minimum information required to create a single incident via the API is the incident name.
* [Fetch Incidents From an Integration Instance](/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle.md#UUID-29efc484-3f74-0a0c-9203-313476e58886).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.