Skip to main content
This feature isn’t available to all Palo Alto Networks Cortex XCOR users and might not be visible in your app. For information about enabling this feature in your environment, contact Cortex XCOR Support.
An investigation presents its work in three collapsible sections: Context, Investigation activity, and Findings. While the investigation runs, the first two sections fill in. When it finishes, Findings appears and the earlier sections collapse, because the findings summarize what they produced.
Generative AI features can produce incorrect results, hallucinate data, and deliver inaccurate analysis. Use generative AI features with care, and independently verify all information produced by generative AI tools before applying it.Certain prompts, data, or other inputs might produce irrelevant content. Don’t rely on generative AI features or responses for any uses that exceed their designed scope.

​
Investigation metadata

The page header displays the investigation’s name, taken from the alert it started from, and a badge with its outcome. A metadata bar under the export actions displays when the investigation started, how long it ran, and who started it. Automatic investigations display Auto-run in place of an account. Feedback controls for the whole investigation sit at the opposite end of the same bar.

​
Context

Context establishes what the investigation is looking at before it looks for a cause. This includes:
  • A link to what started the investigation, such as an Alert, Panel, or Operator.
  • The investigation’s starting timestamp.
  • Any services and labels checked in the investigation.
Read this section to confirm the investigation understood the problem correctly. A context section that resolved the wrong service or the wrong time window explains findings that go on to answer the wrong question.

​
Investigation activity

The Investigation activity section lists explanations that the investigation considered, including:
  • Causal chain events: Sequential events that would produce the symptom if this explanation is correct.
  • Correlated observations: Findings that line up with the explanation but don’t establish causation.
  • Cleared areas: Explanations that the investigation ruled out are collected in this group and collapsed. Ruled-out explanations still matter because they describe what you don’t need to examine.
Each item is framed as a question and a one-line summary response. You can expand each item to view additional contextual details for that item’s conclusion, including charts and queries when relevant. Tasks that found something appear first. Tasks that completed without findings are grouped into the Cleared areas entry at the end of the list. Expand that group to confirm which possibilities the investigation eliminated. A task marked Experimental uses a capability that Cortex XCOR is still validating. Weigh its findings accordingly.

​
Findings

The Findings section contains the investigation’s conclusion. It opens with a summary of the leading explanation in a sentence or two, including the agent’s conclusion and its confidence in its findings. The section then provides:
  • Charts: The alert’s query alongside the decisive evidence, so you can compare the symptom against the proposed cause on the same time axis. Markers on the chart indicate alerts and related change events.
  • Recommended next steps: Actions to confirm or act on the finding, such as a targeted query to run, or a rollback to consider when a change is the likely cause.
  • Supporting evidence: The claims behind the conclusion, in chronological order.
  • Alternatives ruled out: A summary of other potential explanations that the investigation challenged.
  • Open Questions: Details that the investigation couldn’t determine on its own. These become the suggested follow-up prompts.
A complete investigation’s findings can include a conclusion that there was no issue. In such investigations, review the recommended next steps to improve the source that triggered the investigation.

​
Verify a claim

Each claim under Supporting evidence is a one-line headline you can expand to see the telemetry behind it. This can include the chart, query, trace, or event the agent used to make it. Expand the claims that carry the most weight in the conclusion and confirm the evidence supports them. A claim you can’t verify is a claim to treat as a lead rather than a fact. Each expanded claim also has feedback controls.

​
Investigation outcomes

An investigation’s outcome appears as a badge beside its name in the page header, and in the Outcome column of the investigations list: A Partial findings outcome isn’t a failure. An investigation reports what it can support rather than asserting a root cause that lacks sufficient evidence. A partial result with a clear set of open questions is often the correct outcome, and it’s a good starting point for a follow-up.

​
Save or share an investigation

Two actions at the top of a finished investigation preserve it:
  • Save as notebook creates a notebook containing the full report, named after the source alert. Use this to attach the investigation to an incident record, add your own findings, or share it with responders who weren’t involved.
  • Copy investigation copies the report to your clipboard as Markdown, for pasting into a chat thread, ticket, or postmortem.
Individual sections also have copy controls, so you can take only the reasoning or only the context. To share the live report instead of a copy, send its URL. A follow-up chain opens at the investigation the link points to.