> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md).

# Investigate an Incident Using the Canvas

Visually map and investigate Cortex XSOAR 6.15 incident relationships with the investigation canvas.

The Investigation Canvas enables you to visually map an incident, its elements, and progression path, combining analyst intelligence with machine learning.

To access the investigation canvas, click **Canvas** from the incident you want to investigate. The incident appears on the canvas display. In the **Add entity to canvas** section, DBot provides suggested indicators and incidents that might be connected or relevant to the current incident for you to add to the canvas.

Searches are server-side searches.

![canvas.png](https://content.gitbook.com/content/8xEMUKpU65o1wagTHaO3/blobs/oNforThW7SXOQt3L8JlO/437aaefe5f4156a2aaf52e9bc66ee62a6ce2185e7c919fe16a6a3c3a06994de3.png)

### Suggested incidents for the investigation canvas

The incidents are calculated according to the related incidents algorithm, which are based on several factors:

* Common labels
* Common indicators
* Common incident custom fields

You can add incidents by dragging and dropping them onto the canvas.

### Suggested indicators for the investigation canvas

The indicators are determined according to the following factors (in this order):

1. Indicators with a malicious verdict from the original incident (the incident that initiated the investigation).
2. Indicators shared between incidents that you added to the canvas.
3. The malicious ratio, which is the ratio between the indicators that appear in incidents with a malicious verdict, compared to the total number of incidents in Cortex XSOAR.

You can add the indicators by dragging and dropping the indicators onto the canvas.

{% hint style="info" %}

### Configure DBot incident and indicator suggestions

You can [Edit Dbot Incident and Indicator Suggestions](/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md) in the Entity Library.
{% endhint %}

### Investigation canvas features

You can do the following:

* [Auto Populate the Canvas](/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/auto-populate-the-canvas.md) with related incidents, suspicious URLs, etc by using machine learning.

  The closer an entity appears to the center, the more closely related it is to the investigated incident.
* **View an incident and indicator**: View details of the incident and indicator, including various actions in the [Dbot Suggestions: Quick View Window](/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md).
* **Connect incidents**: connect each incident by linking each incident and use comments on entity connections to communicate important information with team members by adding notes to connectors between entities.

  ![link\_incident.png](https://content.gitbook.com/content/8xEMUKpU65o1wagTHaO3/blobs/oXumpB3XTDIM1oGg3kWQ/53875d22b7435ff319238406fa37cb17badc884a4d4b5e49de3b8e01e98e256a.png)
* **Dynamic Connections**: when you rearrange entities on the canvas, the connections dynamically move with the entities. Connections that are dotted lines indicate that the indicator is part of the investigation, or two incidents are defined as related incidents. These connections are dynamic, which means if one entity is an IP address and you add that IP address to the allow list after it was added to the canvas, the dotted-lined connection is automatically removed.
* **Capture the Canvas as an image**: capture and study the incident by clicking **Export to PNG**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.