> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate alerts automatically

> Understand how automatic investigations start when alerts trigger, and which alerts to select for them.

> [!NOTE]
>
> This feature is in Early Access (EA), and might not be visible in your app. To learn
> more about this program and the features it contains, see the
> [Early access](/early-access.md) page.

Cortex XCOR can start an [investigation](/investigate/investigations)
automatically when an alert triggers. Because an investigation takes a few minutes,
starting one at alert time means the findings are often ready by the time a
responder opens the alert.

> [!WARNING]
>
> Generative AI features can produce incorrect results, hallucinate data, and deliver
> inaccurate analysis. Use generative AI features with care, and independently verify
> all information produced by generative AI tools before applying it.
>
> Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
> generative AI features or responses for any uses that exceed their designed scope.

Cortex XCOR configures automatic investigations for your tenant. To enable them or
change which alerts trigger them, contact [Cortex XCOR Support](/support.md). Use
this page to decide what to ask for.

## How triggering works

When an alert triggers, Cortex XCOR evaluates that alert against the trigger rules
configured for your tenant. A match starts an investigation for the alert.

Nothing triggers by default. If you don't configure a trigger rule, none of your
alerts will start an investigation. Automatic investigations are opt-in and only
for the alerts you configure.

> [!NOTE]
>
> XCOR has a limit on the number of automatic investigations that can run concurrently.
> If you expected an investigation to automatically start and it doesn't, you might need
> to [start the investigation](/investigate/investigations/start.md) manually.

## Select alerts to investigate

Trigger rules match alerts on the properties in the following table, which you can
combine:

| Property | Selects |
| - | - |
| Monitor name or slug | Specific [monitors](/investigate/alerts/monitors), matched by pattern |
| Monitor labels | Monitors carrying particular labels, such as a team or tier |
| Notifier type | Every alert notifying through a given [notifier](/investigate/alerts/notifications/notifiers) type, such as PagerDuty, OpsGenie, or Slack |
| Notifier name or slug | Alerts that notify a specific notifier |
| [Notification policy](/investigate/alerts/notifications/policies.md) | Alerts routed by a specific policy |

Within a single rule, all the properties you specify must match. Across rules, a
match on any one rule triggers an investigation. This lets you express a broad rule
and a narrow one together, such as everything that pages through PagerDuty, plus
every checkout monitor regardless of where it notifies.

## Choose a starting scope

Investigation quality depends on the alert that starts it, so scope matters more
than coverage.

### Start with alerts that page a person

An alert worth waking someone for is an alert worth investigating. Filtering on
a paging notifier type, such as PagerDuty or OpsGenie, and restricting to critical
severity is a reasonable first configuration.

### Prefer alerts that indicate real deviation

An investigation of a noisy or poorly tuned alert produces poor findings, because
there's often nothing to find. That erodes trust in the feature faster than missing
coverage does.

### Expand after you've reviewed results

Once the initial scope produces findings your responders act on, widen it to
lower-severity alerts or additional notifiers. Cortex XCOR can estimate the volume
that a proposed scope would generate before enabling it.

### Exclude pre-production alerts unless you plan to read them

Non-production environments generate high alert volume with low review rates.

## Recognize an automatic investigation

Automatic investigations are identical to ones you start yourself. They differ only
in how they began:

* The **Run by** column in the investigations list displays **Auto-run**.
* The investigation's metadata bar displays **Auto-run** instead of an account.

On the alert details page, an alert with a completed automatic investigation
displays its summary in the investigation card, and the button reads
**Show investigation** rather than **Start investigation**.


## Related topics

- [Investigate alerts with AI investigations](/investigate/investigations.md)
- [Alert details](/investigate/alerts/alert-details.md)
- [Cortex XCOR concepts](/overview/concepts.md)
- [Investigate your telemetry data](/investigate.md)
- [Start an investigation](/investigate/investigations/start.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.