Issue feed ↗

In Cortex XSIAM, the issue feed provides a chronological visualization of the case lifecycle, highlighting key case information from initial detection to the most recent activity. Key features include:

• Issue count: See the total number of issues linked to the case.
• High level details: Review issue details in the timeline, or click an issue to open the full issue card. When an issue is resolved, the issue status and title is dimmed.
• Contextual insights: View integrated insights directly within the timeline (when available), providing extra layers of intelligence on why specific events were flagged.
• Unified progression: Gain immediate clarity on the speed of an attack, helping you distinguish between rapid automated threats and slow-moving lateral movement.
• Group issues by attribute: Sort the issues in the timeline with the Group By option that allows you cluster issues and insights by selected criteria, such as category, severity, detection method, or detection rule.
• Browse issues in the feed: Open an issue and use the arrows in the top left corner to browse through the issue cards.