Optimize Cortex XSIAM case grouping by mapping correlation rule fields that influence grouping and prioritization. When custom detections generate issues, related issues might not automatically group into cases.
Case grouping uses Cortex XSIAM machine learning and grouping logic. It evaluates relationships, context, and shared artifacts across issues.
Map specific correlation rule fields to influence case grouping and prioritization.
### Why correlation rule field mapping matters for case grouping
Cortex XSIAM grouping and machine learning models use mapped fields to construct grouping artifacts. These artifacts help evaluate whether issues are related or part of an ongoing activity.
Not all fields influence grouping. To contribute effectively to grouping and prioritization, your correlation rules must supply one or more of the relevant fields in a supported format that Cortex XSIAM can interpret. In addition, ensure that the mapped fields adhere to the correct field structure, and expected formatting requirements.
If these fields are missing, incorrectly mapped, or improperly formatted, Cortex XSIAM may be unable to correlate related issues accurately. This can reduce grouping effectiveness and lead to unnecessary issue fragmentation across multiple cases.
Benefits of proper grouping configuration:
* Correlate related custom issues into a single investigative workflow
* Reduce issue and case fragmentation
* Reduce over grouping of issues in cases
* Improve investigation efficiency
* Strengthen ML-based prioritization and correlation
* Align custom detections with organizational context
Field mapping does not guarantee grouping.
Cortex XSIAM grouping uses machine learning and platform logic that evaluates confidence, context, relationships, and additional case signals. Field mapping helps influence grouping by contributing relevant artifacts, but final grouping decisions are determined by the platform’s overall grouping logic.
For more information about case grouping behavior, see [Case grouping](../../detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping).
## **Configure field mapping to optimize grouping**
To optimize grouping for issues generated by correlation rules, take the following steps:
1. **Create or edit a correlation rule:** Define the logic that triggers the issue based on your specific security requirements. For full instructions on creating correlation rules, see [Create a correlation rule](../../detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/create-a-correlation-rule).
2. **Map fields to influence grouping:** Map your data to the fields for which you want to group (e.g., IP Artifact, Actor Artifact, User). The grouping engine uses these fields to identify commonalities across different issues.
For details of the specific fields that influence case grouping and their expected formatting requirements, see the table below.
### Case grouping field-mapping best practices
* Use stable identifiers that are likely to remain consistent across related detections
* Ensure field values match expected Cortex formats
* Avoid overly broad mappings that may unintentionally group unrelated issues
* Use the same mapping strategy across related custom rules when consistent grouping is desired
### Case grouping artifact field mapping reference
The following table presents the full set of fields that influence case grouping, their descriptions, and the expected formats.
<table><thead><tr><th width="121.5">Artifact type</th><th>Details</th></tr></thead><tbody><tr><td><strong>Actor Artifact</strong></td><td><ul><li><strong>Field name:</strong> Initiator SHA256</li><li><strong>Description (Purpose):</strong> The process hash is a SHA256 identifier of the initiator executable, independent of name or path.</li><li><strong>Field type:</strong> SHA256</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456</code> (64 hexadecimal characters)</li><li><strong>Valid:</strong> <code>E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855</code> (uppercase also valid)</li><li><strong>Invalid:</strong> <code>abc123</code> (must be exactly 64 characters)</li><li><strong>Invalid:</strong> <code>0000000000000000000000000000000000000000000000000000000000000000</code> (empty hash, excluded)</li></ul></li></ul></td></tr><tr><td><strong>Causality Artifact</strong></td><td><ul><li><strong>Field name:</strong> CGO SHA256</li><li><strong>Description (Purpose):</strong> The SHA256 hash value of the Causality actor process that initiated the issue.</li><li><strong>Field type:</strong> SHA256</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456</code> (64 hexadecimal characters)</li><li><strong>Valid:</strong> <code>E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855</code> (uppercase also valid)</li><li><strong>Invalid:</strong> <code>abc123</code> (must be exactly 64 characters)</li><li><strong>Invalid:</strong> <code>0000000000000000000000000000000000000000000000000000000000000000</code> (empty hash, excluded)</li></ul></li></ul></td></tr><tr><td><strong>Process Artifact</strong></td><td><ul><li><strong>Field name:</strong> Target process SHA256</li><li><strong>Description (Purpose):</strong> The SHA256 hash value of the target process affected by the action, such as the injectee in injection.</li><li><strong>Field type:</strong> SHA256</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456</code> (64 hexadecimal characters)</li><li><strong>Valid:</strong> <code>E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855</code> (uppercase also valid)</li><li><strong>Invalid:</strong> <code>abc123</code> (must be exactly 64 characters)</li><li><strong>Invalid:</strong> <code>0000000000000000000000000000000000000000000000000000000000000000</code> (empty hash, excluded)</li></ul></li></ul></td></tr><tr><td><strong>File Artifact</strong></td><td><ul><li><strong>Field name:</strong> File SHA256</li><li><strong>Description (Purpose):</strong> The file hash artifact represents the SHA256 cryptographic hash of a file involved in the issue. This could be a file that was created, modified, or accessed.</li><li><strong>Field type:</strong> SHA256</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2</code> (64 hex chars)</li><li><strong>Invalid:</strong> <code>abc</code> (too short)</li><li><strong>Invalid:</strong> <code>not-a-hash</code> (non-hexadecimal characters)</li></ul></li></ul></td></tr><tr><td><strong>IP Artifact</strong></td><td><ul><li><strong>Field name:</strong> Remote IP</li><li><strong>Description (Purpose):</strong> This field represents the IP address associated with the network event. It typically refers to the remote/destination IP address that the endpoint communicated with.</li><li><strong>Field type:</strong> IPv4 string (e.g., 192.168.1.1)</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>192.168.1.25</code> (IPv4 address, values 0-255)</li><li><strong>Valid:</strong> <code>8.8.8.8</code> (public IP)</li><li><strong>Invalid:</strong> <code>192.168.300.25</code> (values must be between 0-255)</li><li><strong>Invalid:</strong> <code>192.168.1</code> (incomplete address)</li></ul></li></ul></td></tr><tr><td><strong>IPv6 Artifact</strong></td><td><ul><li><strong>Field name:</strong> Remote IPv6</li><li><strong>Description (Purpose):</strong> The IPv6 address artifact represents the 128-bit IP address in the newer Internet Protocol version 6 format. Like IPv4, it identifies network communication endpoints but uses a different addressing scheme.</li><li><strong>Field type:</strong> IPv6 string (e.g., 2001:0db8::1)</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code> (full format)</li><li><strong>Valid:</strong> <code>2001:db8:85a3::8a2e:370:7334</code> (compressed format)</li><li><strong>Invalid:</strong> <code>2001:0db8:85a3:0000:0000:8a2e:0370:GGGG</code> (invalid hex characters)</li></ul></li></ul></td></tr><tr><td><strong>Domain Artifact</strong></td><td><ul><li><strong>Field name:</strong> DNS Query Name</li><li><strong>Description (Purpose):</strong> The domain artifact represents the fully qualified domain name (FQDN) or hostname that was accessed during the network event. This can come from DNS queries or HTTP/HTTPS requests.</li><li><strong>Field type:</strong> DNS name string (e.g., example.com)</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>malicious-site.com</code> (normalized to lowercase)</li><li><strong>Valid:</strong> <code>subdomain.example.org</code> (subdomains included)</li><li><strong>Invalid:</strong> <code>192.168.1.1</code> (IP addresses are not domains)</li><li><strong>Invalid:</strong> <code>example..com</code> (double dots invalid)</li></ul></li></ul></td></tr><tr><td><strong>Cmd Artifact</strong></td><td><ul><li><p><strong>Field name:</strong></p><ul><li>Initiator CMD</li><li>Initiator Path</li><li>Initiated By</li></ul></li><li><strong>Description (Purpose):</strong> The command line artifact captures the full command line used to execute a process, including all arguments and parameters. This is normalized (lowercased, trimmed, spaces standardized) to ensure consistent matching.</li><li><strong>Field type:</strong> Raw string</li><li><p><strong>Format:</strong></p><ul><li><p><strong>Initiator CMD:</strong> Minimum command line length of 5 without spaces and program image name.</p><ul><li><strong>Valid:</strong> <code>powershell.exe -ExecutionPolicy Bypass -File “C:\ProgramData\setup.ps1”</code></li></ul></li><li><p><strong>Initiator Path:</strong> Not empty</p><ul><li><strong>Valid:</strong> <code>C:\Windows\System32\powershell.exe</code></li></ul></li><li><p><strong>Initiator By:</strong> Not empty</p><ul><li><strong>Valid:</strong> <code>powershell.exe</code></li></ul></li></ul></li><li><p><strong>Notes:</strong></p><ul><li>All fields need to be mapped and non-empty.</li></ul></li></ul></td></tr><tr><td><strong>HOST</strong></td><td><ul><li><strong>Field name:</strong> Host Name</li><li><strong>Description (Purpose):</strong> The hostname artifact identifies the computer or device where the event occurred. This can be a NetBIOS name, DNS hostname, or in some cases a local IP address (for firewall alerts without hostname). Hostnames are normalized and length-limited to ensure consistent matching.</li><li><strong>Field type:</strong> String</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>DESKTOP-ABC123</code> (Windows hostname)</li><li><strong>Valid:</strong> <code>server01.corp.local</code> (FQDN)</li><li><strong>Valid:</strong> <code>ubuntu-server</code> (Linux hostname)</li><li><strong>Invalid:</strong> <code>host name with spaces</code> (spaces not allowed)</li></ul></li></ul></td></tr><tr><td><strong>AGENT_ID</strong></td><td><ul><li><strong>Field name:</strong> Agent ID</li><li><strong>Description (Purpose):</strong> The Agent ID is a unique identifier assigned to each endpoint agent installed in the environment. This ID persists across hostname changes and reinstalls, making it a reliable identifier for tracking a specific device.</li><li><strong>Field type:</strong> String</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6</code> (alphanumeric string)</li><li><strong>Valid:</strong> <code>{12345678-90AB-CDEF-1234-567890ABCDEF}</code> (GUID format)</li><li><strong>Invalid:</strong> <code>agent-123</code> (format depends on agent type)</li></ul></li></ul></td></tr><tr><td><strong>USER</strong></td><td><ul><li><strong>Field name:</strong> User name</li><li><strong>Description (Purpose):</strong> The username artifact represents the user account that was active during the event. This is normalized to include both the username and domain (if applicable) in the format domain\username or username@domain. The system excludes common system accounts (SYSTEM, LOCAL SERVICE, etc.) and known service accounts to focus on actual user activity. Cloud identities have special handling for IAM users, service accounts, and federated identities.</li><li><strong>Field type:</strong> String</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> <code>DOMAIN\jsmith</code> (Windows domain user)</li><li><strong>Valid:</strong> <code>jsmith@company.com</code> (email format)</li><li><strong>Valid:</strong> <code>jsmith</code> (local user)</li><li><strong>Invalid:</strong> <code>SYSTEM</code> (excluded as common account)</li><li><strong>Invalid:</strong> <code>NT AUTHORITY\SYSTEM</code> (excluded as system account)</li></ul></li></ul></td></tr><tr><td><strong>URL</strong></td><td><ul><li><strong>Field name:</strong> Url</li><li><strong>Description (Purpose):</strong> The URL associated with the alert. It typically refers to a web address observed in the activity that triggered the alert — such as a URL accessed by a user, contained in an email, or referenced by a network request.</li><li><strong>Field type:</strong> String</li><li><p><strong>Format:</strong></p><ul><li><strong>Valid:</strong> http://www.maliciousdomain.com/some-malware</li></ul><p><strong>Notes:</strong></p><ul><li>Supported only in Platform.</li></ul></li></ul></td></tr><tr><td><strong>External Grouping Artifact</strong></td><td><ul><li><p><strong>Field name:</strong></p><ul><li>Case Grouping External Artifact Name</li><li>Case Grouping External Artifact Id</li></ul></li><li><strong>Description (Purpose):</strong> Groups issues into cases using external parent-object logic. It preserves grouping structure from third-party tools to ensure seamless alert consolidation in our system.</li><li><strong>Field type:</strong> String</li><li><p><strong>Format:</strong></p><ul><li><p><strong>Case Grouping External Artifact Name:</strong></p><ul><li><strong>Valid:</strong> Corp SIEM</li></ul></li><li><p><strong>Case Grouping External Artifact Id:</strong></p><ul><li><strong>Valid:</strong> INC0012345</li></ul></li></ul></li><li><p><strong>Notes:</strong></p><ul><li>Supported only in Platform.</li><li>Both fields need to be mapped and non-empty.</li></ul></li></ul></td></tr></tbody></table>
### Correlation rule case grouping examples
#### **Example 1:**
Group multiple suspicious login detections by user
The correlation rule detects:
* Impossible travel login
* Multiple failed logins
* Privileged login from new location
**Map:**
* User name → (e.g. jsmith@company.com)
**Result:** Issues that share the same user are more likely to group into a single case.
#### **Example 2:**
Group endpoint persistence detections by host
The correlation rule detects:
* Registry persistence
* Suspicious scheduled task
* New service installation
**Map:**
* `Host Name` → (e.g. DESKTOP-ABC123)
* `Agent ID` → <_Agent_\__ID_>
**Result:** Issues on the same endpoint are more likely to group into a shared case for endpoint investigation.
#### **Example 3:**
Group phishing detections by sender domain
The correlation rule detects:
* Suspicious attachment
* Spoofed sender
* Credential harvesting link
**Map:**
* `DNS Query Name` → Domain (e.g malicious-site.com)
**Result:** Related phishing activity tied to the same domain may group more effectively.