Investigation and response

[overview-of-cases](investigation-and-response/overview-of-cases)

[case-concepts](investigation-and-response/case-concepts)

[analyze-and-resolve-cases](investigation-and-response/analyze-and-resolve-cases)

[investigate-issues](investigation-and-response/investigate-issues)

[review-findings](investigation-and-response/review-findings)

[investigate-artifacts-and-assets](investigation-and-response/investigate-artifacts-and-assets)

[investigate-endpoints](investigation-and-response/investigate-endpoints)

[investigate-files](investigation-and-response/investigate-files)

[cortex-assistant](investigation-and-response/cortex-assistant)

[response-actions](investigation-and-response/response-actions)

[forensics](investigation-and-response/forensics)

[notebooks](investigation-and-response/notebooks)

[build-xql-queries](investigation-and-response/build-xql-queries)

[research-a-known-threat](investigation-and-response/research-a-known-threat)

Sub-topics

• Overview of cases
  • What are cases?
  • Resolving cases with AI
  • Case lifecycle
  • Case thresholds
  • Case scope and impact
  • Case and issue domains
  • Overview of case teams and roles
• Case concepts
  • Issues, findings, and events
  • Case grouping
  • Case scoring
  • Case starring
  • SLAs and tracking
  • What is Causality?
• Analyze and resolve cases
  • Review all cases
  • Start case analysis
    • Agentic Assistant- Case Investigation agent
  • Establish case context
    • AI-generated case summaries
    • Assess case severity and score
    • Update case attributes
  • Analyze case details
    • Grouping graph
    • Evidence
    • Issue feed
    • Associated assets and artifacts
    • MITRE ATT&CK tactics and techniques
    • Compliance standards and controls
    • Case timeline
    • Detailed View
  • Resolve the case
    • Resolution Center
    • Collaborative notes and comments
    • How to resolve a case
    • Resolution reasons for cases and issues
    • Monitor and track resolution times
    • Cortex Response and Remediation content pack
      • Investigate an issue using Cortex Response and Remediation playbooks
      • Example use cases
  • Additional case actions
    • Create a case
    • Merge a case
    • Assign a case team and restrict access
      • Playbook examples
    • Unified case view
• Investigate issues
  • Overview of the Issues page
  • Issue card
  • Resolution actions
  • Link or unlink issues from a case
  • Run an automation on an issue
  • Use the War Room in an investigation
  • Use the Work Plan in an investigation
  • Issue syncing
  • Issue deduplication
  • Causality view
    • Network causality view
    • Cloud causality view
    • Cloud causality view for audit log issues
    • SaaS causality view
    • Timeline
    • Causality icons key
  • Issue investigation actions
    • Copy issues
    • Analyze an issue
    • Update issue fields
    • Query case and issue data
    • Exclude an issue
    • Create a featured field
    • Export issue details to a file
    • Investigate contributing events
    • Retrieve additional issue details
    • View generating BIOC or IOC rule
    • Create profile exceptions
    • Add a file path to a malware profile allow list
    • Close an issue
• Review findings
  • Findings card
• Investigate artifacts and assets
  • Investigate an IP address
  • Investigate an asset
  • Investigate a host
  • Investigate a file and process hash
  • Investigate a user
• Investigate endpoints
  • Overview of the Action Center
    • Initiate and monitor endpoint actions
    • Action Center reference information
  • Manage endpoints
  • Retrieve files from an endpoint
  • Retrieve support logs from an endpoint
  • Retrieve support file password
  • Scan an endpoint for malware
• Investigate files
  • Manage file execution
  • Manage quarantined files
  • Review WildFire analysis details
  • Import file hash exceptions
• Cortex Assistant
  • Cortex Assistant layout
  • Cortex Assistant capabilities
• Response actions
  • Initiate a Live Terminal session
  • Isolate an endpoint
  • Pause endpoint protection
  • Run agent scripts on an endpoint
  • Remediate changes from malicious activity
  • Search and destroy malicious files
  • Manage external dynamic lists
  • Collect a memory image
• Forensics
  • Forensic investigations
  • Manage an investigation
    • Create a new investigation
    • Edit an investigation
    • Close an investigation
    • User permissions
  • Data collection
    • Hunting
      • Create a hunt
      • Hunt results
      • Hunt status
    • Triage
      • Create a triage
      • Upload an offline triage package
      • Offline triage collection
      • Triage results
      • Triage status
    • Configure collection
  • Analysis and documentation
  • Export
• Notebooks
  • Manage datasets in Notebooks
  • Notebooks scheduler
• Build XQL queries
  • About the Query Builder
  • How to build XQL queries
    • Get started with XQL queries
    • Useful XQL user interface features
    • XQL Query best practices
    • Expected results when querying fields
    • Create XQL query
    • Review XQL query results
    • Translate to XQL
    • Graph query results
  • Query Builder templates
    • Get started with Query Builder templates
    • Considerations for using Query Builder templates
    • Create a query from a template
    • Run a free text query
    • Query Builder template examples
  • Overview of the Query Center
    • Edit and run queries in Query Center
    • Query Center reference information
  • Manage scheduled queries
    • Scheduled Queries reference information
  • Manage your personal query library
  • XQL macros
  • Manage your macros
  • Federated Search
    • Federated Search configuration
    • Query using Federated Search
    • Manage external datasets
  • Legacy Query Builder
    • Create authentication query
    • Create event log query
    • Create file query
    • Create image load query
    • Create network connections query
    • Create network query
    • Create process query
    • Create registry query
    • Query across all entities
• Research a known threat