> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md).

# Dbot Suggestions: Quick View Window

Review DBot incident and indicator suggestions in the Cortex XSOAR 6.15 canvas quick view.

The Quick View window displays information for the entity selected on the canvas, either an incident or an indicator, each of which have DBot suggested indicators.

You can highlight entities on the canvas to show visually how the incident progressed.

Searches performed in the Quick View pane are client-side searches.

![indicators\_canvas.png](https://content.gitbook.com/content/8xEMUKpU65o1wagTHaO3/blobs/fAMEkbNKY9O14aFEn3bw/2016ab2aeaee7b5a42673822b9d6d2917ba5cc852cbaa18721b62c50fbb200d9.png)

### **Incident Quick View**

You can view basic information, such as type, severity, time line information labels, and indicators. The indicators that DBot suggests to add to the canvas for this incident are determined according to the following factors (in this order):

1. Indicators with a malicious verdict from the current (selected) incident.
2. The malicious ratio, which is the ratio between the indicators that appear in incidents with a malicious verdict, compared to the total number of incidents in Cortex XSOAR.

### **Indicator Quick View**

You can view source information, hashes, known history, comments and do certain actions such as run scripts, delete, and exclude.

The indicators that DBot suggests to add to the canvas for the selected indicator are determined according to the following factors (in this order):

1. Relations between all canvas investigation contexts. For example, if a hostname and IP address are associated with the same endpoint, the context key is suggested as an indicator.
2. An ssdeep with 50% or higher similarity.

You can [Edit Dbot Incident and Indicator Suggestions](/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md) in the **Quick View** window.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.