Skip to main content
This feature is in Early Access (EA), and might not be visible in your app. To learn more about this program and the features it contains, see the Early access page.
Cortex XCOR can start an investigation automatically when an alert triggers. Because an investigation takes a few minutes, starting one at alert time means the findings are often ready by the time a responder opens the alert.
Generative AI features can produce incorrect results, hallucinate data, and deliver inaccurate analysis. Use generative AI features with care, and independently verify all information produced by generative AI tools before applying it.Certain prompts, data, or other inputs might produce irrelevant content. Don’t rely on generative AI features or responses for any uses that exceed their designed scope.
Cortex XCOR configures automatic investigations for your tenant. To enable them or change which alerts trigger them, contact Cortex XCOR Support. Use this page to decide what to ask for.

​
How triggering works

When an alert triggers, Cortex XCOR evaluates that alert against the trigger rules configured for your tenant. A match starts an investigation for the alert. Nothing triggers by default. If you don’t configure a trigger rule, none of your alerts will start an investigation. Automatic investigations are opt-in and only for the alerts you configure.
XCOR has a limit on the number of automatic investigations that can run concurrently. If you expected an investigation to automatically start and it doesn’t, you might need to start the investigation manually.

​
Select alerts to investigate

Trigger rules match alerts on the properties in the following table, which you can combine: Within a single rule, all the properties you specify must match. Across rules, a match on any one rule triggers an investigation. This lets you express a broad rule and a narrow one together, such as everything that pages through PagerDuty, plus every checkout monitor regardless of where it notifies.

​
Choose a starting scope

Investigation quality depends on the alert that starts it, so scope matters more than coverage.

​
Start with alerts that page a person

An alert worth waking someone for is an alert worth investigating. Filtering on a paging notifier type, such as PagerDuty or OpsGenie, and restricting to critical severity is a reasonable first configuration.

​
Prefer alerts that indicate real deviation

An investigation of a noisy or poorly tuned alert produces poor findings, because there’s often nothing to find. That erodes trust in the feature faster than missing coverage does.

​
Expand after you’ve reviewed results

Once the initial scope produces findings your responders act on, widen it to lower-severity alerts or additional notifiers. Cortex XCOR can estimate the volume that a proposed scope would generate before enabling it.

​
Exclude pre-production alerts unless you plan to read them

Non-production environments generate high alert volume with low review rates.

​
Recognize an automatic investigation

Automatic investigations are identical to ones you start yourself. They differ only in how they began:
  • The Run by column in the investigations list displays Auto-run.
  • The investigation’s metadata bar displays Auto-run instead of an account.
On the alert details page, an alert with a completed automatic investigation displays its summary in the investigation card, and the button reads Show investigation rather than Start investigation.