Documentation — August 24, 2026

425 files changed, 2652 insertions, 1119 deletions — view the commit on the mirror.

Editorial pass over 424 XSIAM pages: 276 gain search descriptions, two lose reference detail

276 pages gained a description frontmatter block and 73 more had theirs rewritten, a metadata pass covering most of the Cortex XSIAM book.
Headings and prose were rewritten to name Cortex XSIAM explicitly, and the multi-tenant child tenant pages moved from Incidents and Alerts to Cases and Issues.
Two pages lost reference detail: the node icons table in the causality icons key, and the step-by-step rule criteria in Set up case scoring.
Twelve stub section pages gained child page indexes, and three pages had collapsible sections flattened into ordinary headings.
No page was added, removed or renamed; nine navigation titles changed, but every path stayed put.

Highlights

The causality icons key lost its node icons table

Twenty-three lines of node icon rows were deleted, leaving the section heading and its one-line introduction with nothing beneath them.
Set up case scoring dropped its step-by-step rule criteria

The substeps covering rule name, score, base rule, the apply-to-first-issue-only option and filter selection were replaced by the worked example alone.
Child tenant management now says Cases and Issues, not Incidents and Alerts

Across three multi-tenant pages the parent tenant's viewable page list and its configurable actions were renamed, including Starred Issue Policies and Issue Exclusions.
276 pages gained a search description

Pages that carried no frontmatter description now have one, and 73 existing descriptions were rewritten to name the product and the task.
Device control was restructured and rebranded

The page gained capabilities, prerequisites and limitations headings, and the Cortex XDR references in its Bluetooth limitation rows became Cortex XSIAM.
Twelve stub section pages gained child page indexes

Cloud Identity Security, Endpoint DLP and Remote repository management were one-line stubs that now list the pages beneath them.

Bulk change — 425 files. Per-file diffs are not stored for a change this size; view it on the mirror.

Changes

425 files listed, 15 written up and shaded below.

▸ ▾ Create rules for case layouts modified +12 −6 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-layouts/create-rules-for-case-layouts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Customize issue fields and layouts modified +6 −0 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage Cortex XSIAM issue fields modified +19 −7 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Automate changes to issue fields using timer scripts modified +6 −0 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/automate-changes-to-issue-fields-using-timer-scripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure a playbook to run timers modified +6 −0 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/configure-a-playbook-to-run-timers

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure issue timer fields modified +8 −2 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/configure-issue-timer-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a grid field for an issue modified +3 −1 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/create-a-grid-field-for-an-issue

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create custom issue fields modified +15 −12 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue field-triggered scripts modified +17 −11 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-field-triggered-scripts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue field types modified +6 −0 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-field-types

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure issue timer fields modified +14 −12 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-timer-fields

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Use issue timer field commands in the CLI modified +9 −3 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/user-issue-timer-field-commands-manually-in-the-cli

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue layouts modified +21 −5 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Add a custom widget to an issue layout modified +6 −0 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/add-a-custom-widget-to-an-issue-layout

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create custom issue layouts modified +8 −2 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-custom-issue-layouts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create issue layout rules modified +14 −8 xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-rules-for-issue-layouts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Optimize case grouping in correlations modified +15 −9 xsiam/configure-cortex-xsiam/customize-cases-and-issues/optimize-case-grouping-in-correlations

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Run indicator extraction in the CLI modified +15 −4 xsiam/configure-cortex-xsiam/customize-cases-and-issues/run-indicator-extraction-in-the-cli

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up case scoring modified +16 −31 The instructions for defining rule criteria were cut down to the example values, and the SmartScore section was retitled. xsiam/configure-cortex-xsiam/customize-cases-and-issues/set-up-case-scoring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Managed Services configuration in Cortex modified +6 −0 xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure actions permissions modified +10 −4 xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-actions-permissions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Configure report forwarding modified +6 −0 xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-report-forwarding

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Manage escalation contacts modified +9 −3 xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/manage-escalation-contacts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Managed Services configuration modified +11 −1 xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/managed-services-configuration

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Multi-Tenant modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ About managed threat hunting modified +3 −1 xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate Managed Threat Hunting reports modified +6 −2 xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting/investigate-managed-threat-hunting-reports

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up Managed Threat Hunting modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting/set-up-managed-threat-hunting

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Child tenant management modified +12 −12 Incidents and Alerts became Cases and Issues, and the configurable actions are now Starred Issue Policies and Issue Exclusions. xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a security managed action modified +15 −9 Six Alert and Incident references were rewritten to Issue and Case wording. xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/create-a-security-managed-action

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create and allocate configurations modified +11 −5 Nine Alert and Incident references were rewritten to Issue and Case wording. xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/create-and-allocate-configurations

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate child tenant data modified +8 −2 xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/investigate-child-tenant-data

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Track your tenant management modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/track-your-tenant-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Dynamic license allocation modified +5 −6 xsiam/configure-cortex-xsiam/multi-tenant/dynamic-license-allocation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Multi-tenant central licensing management modified +7 −3 xsiam/configure-cortex-xsiam/multi-tenant/multi-tenant-central-licensing-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Onboard Cortex multi-tenant modified +9 −2 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Onboarding checklist for multi-tenant central licensing deployments modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Step 1. Activate Cortex XSIAM (main account) modified +13 −25 The default-encryption and BYOK collapsibles were flattened into bullets under the BYOK step. xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-1.-activate-cortex-xsiam-main-account

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a child tenant modified +10 −4 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-2.-create-a-child-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Onboarding checklist for multi-tenant customer-owned license deployments modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Step 1. Active Cortex XSIAM (parent and child tenants) modified +12 −20 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-1.-active-cortex-xsiam-parent-and-child-tenants

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Step 2. Define access configuations and role permissions modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-2.-define-access-configuations-and-role-permissions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Step 3. Pair a parent tenant with a child tenant modified +10 −6 xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-3.-pair-a-parent-tenant-with-a-child-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ What is Cortex XSIAM multi-tenant? modified +3 −3 xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Enterprise multi-tenant modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant/enterprise-multi-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ MSSP multi-tenant modified +6 −0 xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant/mssp-multi-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Remote repository management modified +11 −0 The stub gained a four-entry index of its child pages. xsiam/configure-cortex-xsiam/remote-repository-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex XSIAM development tenant modified +21 −13 Rewritten throughout; the push and pull tenant roles and the list of content that cannot be pushed are restated more directly. xsiam/configure-cortex-xsiam/remote-repository-management/cortex-xsiam-development-tenant

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Push and pull content modified +15 −12 xsiam/configure-cortex-xsiam/remote-repository-management/push-and-pull-content

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Remote repository troubleshooting modified +11 −9 xsiam/configure-cortex-xsiam/remote-repository-management/remote-repository-troubleshooting

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up a remote repository modified +11 −10 xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up a built-in remote repository modified +12 −12 xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository/set-up-a-built-in-remote-repository

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Set up a Private Remote Repository modified +17 −13 xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository/set-up-a-private-remote-repository

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ XQL query management modified +8 −16 Two collapsible blocks became ordinary headings, and a misspelled Prequisite heading was dropped. xsiam/configure-cortex-xsiam/xql-query-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analyze and resolve cases modified +4 −2 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Additional case actions modified +9 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Assign a case team and restrict access modified +7 −2 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Playbook examples modified +8 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Create a case modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/create-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Merge a case modified +8 −2 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Unified case view modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/unified-case-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Analyze case details modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Associated assets and artifacts modified +6 −2 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case timeline modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Compliance standards and controls modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Detailed View modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Evidence modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Grouping graph modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/grouping-graph

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issue feed modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/issue-feed

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ MITRE ATT&CK tactics and techniques modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Establish case context modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ AI-generated case summaries modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Assess case severity and score modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Update case attributes modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/update-case-attributes

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolve the case modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Collaborative notes and comments modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cortex Response and Remediation content pack modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Example use cases modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/example-use-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Investigate an issue using Cortex Response and Remediation playbooks modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/investigate-an-issue-using-cortex-response-and-remediation-playbooks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Monitor and track resolution times modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolution Center modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Resolution reasons for cases and issues modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ How to resolve a case modified +5 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolve-a-case

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Review all cases modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/review-all-cases

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Start case analysis modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Agentic Assistant- Case Investigation agent modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case concepts modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case grouping modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case scoring modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-scoring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Case starring modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-starring

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Issues, findings, and events modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues-findings-and-events

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ SLAs and tracking modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/slas-and-tracking

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ What is Causality? modified +7 −1 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/what-is-causality

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Causality view modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Causality icons key modified +7 −24 The node icons table was removed; the heading and its introduction now stand alone. xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/causality-icons-key

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cloud causality view for audit log issues modified +4 −4 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Cloud causality view modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Network causality view modified +6 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/network-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ SaaS causality view modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/saas-causality-view

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.
▸ ▾ Timeline modified +4 −0 xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/timeline

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Diffs are not stored for a change this size — view it on the mirror.