> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Use notebooks to gather related information
> Use notebooks to gather graphs, charts, and other resources from multiple pages into one place while troubleshooting a problem.
export const AiMessageIcon = props => ;
Use *notebooks* to gather information from multiple pages in Palo Alto Networks Cortex
XCOR. When you're
troubleshooting a problem, you might need graphs, charts, and
other resources to review at the same time. Notebooks let you gather these resources
in one place for ease of review.
Accounts with the `None`
[role](/administer/accounts-teams/teams#available-roles) can open and view notebooks. To
create, edit, or delete a notebook, your account must be a member of a team with the
`Editor` or `SysAdmin` role.
You can work with notebooks in the following ways:
* The [notebooks list](#view-notebooks) shows all your notebooks and opens each one in a
full-screen view.
* The [notebook side panel](#notebook-side-panel) opens over any page so you can add
resources without leaving your current context.
Both edit the same notebooks, so changes you make in one place appear in the other.
## View notebooks
To view all your notebooks, in the navigation menu, select
** Notebooks**. This displays a table listing notebooks you own
or have recently opened, with these controls:
* **Create notebook** opens a new notebook in a full-screen view. See
[Create a notebook](#create-a-notebook).
* **Search notebooks** filters the list by name.
* The ownership filter narrows the list:
* **All** lists every notebook available to you.
* **Mine** lists only notebooks in your personal collection.
* **Shared with me** lists notebooks owned elsewhere that you've opened, such as a
notebook someone [shared with a link](#share-a-notebook).
Each row displays the notebook **Name**, its **Owner**, the **Date modified**, and when
you **Last viewed** it. The list is sorted by **Last viewed** by default. Click a
notebook's **Name** to open it in a full-screen view.
To manage a notebook from the list, click the three
vertical dots icon in its row:
* **Copy Link** copies a [shareable URL](#share-a-notebook) for the notebook.
* **Delete** [removes the notebook](#delete-a-notebook).
### Open a notebook in a full-screen view
When you open a notebook from the notebooks list, it fills the page. A full-screen
notebook includes the [formatting toolbar](#format-text), a
[time range selector](#change-the-time-range),
** Notebook settings**, and
** [Version history](#view-version-history)**.
The full-screen page shows the notebook name as a read-only heading. To rename or
[delete](#delete-a-notebook) the notebook, click ** Notebook
settings**. Use the **Notebooks** breadcrumb to return to the list.
Opening a notebook in full screen closes the [notebook side panel](#notebook-side-panel)
if it was open. Closing the full-screen notebook restores the side panel.
## Notebook side panel
The notebook side panel opens over any page in Cortex XCOR so you can gather resources
without leaving your current context. Cortex XCOR displays the last notebook you
accessed, and your open notebook stays visible as you move between pages.
### Open a notebook
Where the **Notebook** control appears depends on whether it's in the page header
or the right sidebar. Use the tab that matches what you see, or use the keyboard
shortcut `N`.
Click the
** Notebook**
icon in the page header, between [pinned scope](/navigate/pinned-scopes) and search.
After the notebook opens, see [Notebook header](#notebook-header) for full-screen, create,
share, and version history controls.
Click the
** Notebook**
icon in the right sidebar.
If the sidebar is collapsed, press `Control+.` (`Command+.` on macOS) to expand it.
When **Notebook** was the last tab you used, the sidebar reopens to your notebook.
After the notebook opens, see the [Notebook header](#notebook-header) for full-screen,
create, share, and version history controls. Side panel notebooks often use a
[narrow header](#notebook-header-narrow).
### Switch notebooks
To switch notebooks or find a notebook you opened recently:
1. Click ** Select a notebook** in the notebook header.
2. Select the **My Notebooks** or **Recent Notebooks** tab:
* **My Notebooks** lists notebooks in your personal collection. The open
notebook is labeled **(current)** and appears at the top of the list.
* **Recent Notebooks** lists notebooks you opened recently, in order.
3. If needed, filter the list by entering a name in **Search**.
4. Click a **Name** in the table to open the selected notebook. Each row also
displays a **Date** for when the notebook was last updated.
### Notebook header
The top of the notebook side panel provides controls to view the notebook in a full-screen
view, open its version history, copy its contents as Markdown, copy its URL, and create a
notebook. Cortex XCOR shows these controls as separate icon buttons or groups
them in a menu, depending on the width of the notebook header row. The layout switches at
360 pixels. When the header row is narrower than 360 pixels, Cortex XCOR uses a
narrow header. When the row is 360 pixels or wider, it uses a wide header. Resizing the
notebook panel or using a long notebook name can change the header width and switch between
layouts.
Use the tab that matches what you see:
In a narrow header, these actions are grouped in one menu:
1. Click the three vertical dots icon in the
notebook header.
2. Click the action you need:
* [**View full screen**](#open-a-notebook-in-a-full-screen-view)
* [**Version history**](#view-version-history)
* [**Copy as Markdown**](#copy-a-notebook-as-markdown)
* [**Copy URL**](#share-a-notebook)
* [**Create notebook**](#create-a-notebook)
In a wide header, each action appears as its own icon in the notebook header:
* ** [View full screen](#open-a-notebook-in-a-full-screen-view)**
* ** [Version history](#view-version-history)**
* ** [Copy as Markdown](#copy-a-notebook-as-markdown)**
* ** [Copy URL](#share-a-notebook)**
* ** [Create notebook](#create-a-notebook)**
## Share a notebook
Notebooks are stored in a collection. Notebooks you create are stored in your personal
collection, and other users can't see them in **My Notebooks** or **Mine** unless you
share a link. When someone opens a link you share, the notebook opens in their notebook
panel and appears in their **Recent Notebooks** and under **Shared with me** in the
[notebooks list](#view-notebooks).
To share a notebook, copy its URL using one of these controls:
* In the [notebooks list](#view-notebooks), open the row's
three vertical dots menu and click **Copy Link**.
* In the side panel, click ** Copy URL** in the notebook header. If
**Copy URL** isn't visible, click the three vertical
dots icon, and then click **Copy URL**. See [Notebook header](#notebook-header) for both
header layouts.
* In **Select a notebook**, open the row menu and click **Share**.
## Use Markdown with notebooks
Copy a notebook's contents to the clipboard as Markdown, or paste Markdown into an
editable notebook. Cortex XCOR doesn't support importing or
uploading Markdown files.
### Copy a notebook as Markdown
Use the control for the notebook view:
* In a full-screen notebook, click ** Copy as Markdown** in the
toolbar.
* In a wide side panel header, click ** Copy as Markdown**.
* In a narrow side panel header, click the
three vertical dots icon, and then click
**Copy as Markdown**.
The action copies the notebook body to the clipboard. Paste the contents into a text
editor and save the file with an `.md` extension if you need a Markdown file.
The copied Markdown doesn't include the notebook name, collection, owner, version
history, or notebook-wide default time range. A panel-specific time range remains part
of that panel's definition.
### Create a notebook from Markdown
1. [Create a notebook](#create-a-notebook), or open an existing notebook that you can
edit.
2. Copy the Markdown source from your `.md` file or text editor.
3. Click where you want to add the content in the notebook body. Select existing
content first if the pasted Markdown should replace it.
4. Paste with `Control+V` (`Command+V` on macOS).
Cortex XCOR converts Markdown that contains a block element, such as a
heading, list, block quote, fenced code block, table, horizontal rule, or details block.
Markdown that contains only inline syntax might paste as literal text.
### Markdown content and round trips
Notebook content maps to Markdown in the following ways:
* Free-form content uses standard Markdown for paragraphs, headings, bold and italic
text, strike-through text, inline code, links, line breaks, lists, block quotes, code
blocks, horizontal rules, tables, and task lists. Mermaid diagrams use `mermaid` code
fences.
* Visualization panels use `chrono-VizPanel` code fences containing the panel
definition as JSON. The definition includes the queries, display options, and any
panel-specific time range. Pasting the fence restores an interactive panel that runs
its queries, preserving the fence and its JSON without modification.
* Entity link cards become standard Markdown links. Pasting a recognized Cortex XCOR
entity URL restores the link card. An entity without a supported URL becomes
plain text.
* A snapshot uses the same `chrono-VizPanel` representation and retains its snapshot
identifier, but not the captured query data. The imported panel remains a
snapshot only where that identifier is available.
Most supported content survives copying and pasting through Markdown. These structures
change during conversion:
* Merged table cells expand into individual cells, multi-paragraph cells flatten onto
one line, and column alignment normalizes.
* Images become linked alt text because notebooks don't have an image block.
* Underlined text loses its underline. Inline code retains its code formatting but
loses overlapping bold, italic, or link formatting on the same text.
* Unknown notebook content becomes its fallback text, descendant text, or an
`Unsupported notebook content` label.
* Copying Markdown to another tenant doesn't copy referenced entities, snapshots, or
query data.
## View version history
To view the history of changes for a notebook, click **Version history**. In the side
panel, if **Version history** isn't visible, click the
three vertical dots icon in the notebook header, and then click **Version history**. See
[Notebook header](#notebook-header) for both header layouts.
Click **Version history** to display a panel with two tabs:
* [**Code config**](/tooling/gitops#use-the-code-config-tool): Displays a code
representation of the selected entity as of the time of the selected revision.
* **Code diff**: Displays a Git-style diff of the most-recent change made to the
entity, in Cortex XCOR API format. To compare the selected revision to another
revision in the history, click the **Compare With** dropdown and select the
timestamp of the revision that you want to compare.
* Click **Unified** to see the diff stacked horizontally.
* Click **Split** to see changes side by side.
You can see the user, service account, or
[actor](/tooling/api-info#change-actors) which made and the method used for the
last change at the top of the list of changes.
To view a revision in the history, click any entry in the list of timestamped
revisions. The timestamps default to your local time zone.
You can view unchanged lines within the diff by clicking the **Expand X lines**
links.
For a natural language description of the differences between versions, click
**Explain what has changed**. An information box appears with a summary of the
changes. This summary can help users who are less familiar with code updates
understand changes. Use the **thumbs up** or **thumbs down** icon
to indicate whether the explanation was helpful or not.
The Version History view retains up to 500 revisions, or up to 15 months of revisions
if there are fewer than 500 revisions.
### Restore a previous version
To restore a prior version of a notebook while reviewing its version history:
1. Select the version to revert to.
2. Click **Restore to *`DATE`***, where *`DATE`* is the selected version.
3. Click **Restore**.
The notebook refreshes and displays the restored version.
## Reload an updated notebook
If Cortex XCOR detects a newer saved version of the notebook than the
one displayed, an alert displays: **A new version of this notebook is available.**
This can happen in these situations:
* Another user saves changes to a shared notebook you're viewing.
* You edit the same notebook in another browser tab.
Click **Reload** to load the latest saved version.
## Create a notebook
If your personal collection has no notebooks when you open the notebook panel,
Cortex XCOR creates one automatically.
To create another notebook, use one of these controls:
* Click **Create notebook** in the [notebooks list](#view-notebooks). The new notebook
opens in a full-screen view.
* In the side panel, click **Create notebook** in the notebook header. If
**Create notebook** isn't visible, click the three
vertical dots icon, and then click **Create notebook**. See
[Notebook header](#notebook-header) for both header layouts.
* In the side panel, click ** Select a notebook**, and then click
**Create notebook**.
A new notebook opens with a default name like **Untitled notebook ``**. To
rename it in the side panel, click the name. On the full-screen page, click
** Notebook settings**, edit **Notebook name**, and then click
**Save**.
## Add items to your notebook
Notebooks combine dashboard-style panels, entity link cards, and free-form text. This
section describes how to [add a panel](#add-a-panel), insert blocks with the
[command menu](#use-the-command-menu), [format text](#format-text), add a
[Mermaid diagram](#add-a-mermaid-diagram), [link to an entity](#link-to-an-entity),
[Save an investigation report](#save-an-investigation-report), and
[edit a notebook with Operator](#edit-a-notebook-with-operator).
To delete an item from your notebook, click the item and then press `Delete`.
### Add a panel
Add a [dashboard panel](/observe/dashboards/panels) to a notebook in one of the
following ways.
#### From another page
From any page that shows **Add to notebook** in its panel menu, such as
[dashboards](/observe/dashboards) and
[service pages](/observe/services/service-pages):
1. Hold the pointer over the panel, and then click the
three vertical dots icon.
2. Select **Add to notebook**.
3. Select a notebook, or click **Add to new notebook**.
The panel appears at the bottom of your notebook.
#### Drag a panel from a dashboard
1. [Open a notebook](#open-a-notebook).
2. Open a [dashboard](/observe/dashboards).
3. Drag a panel by its header into the notebook. **Drop panel to add to notebook**
appears when the pointer is over the notebook.
#### Copy and paste a panel
1. [Open a notebook](#open-a-notebook).
2. On a [dashboard](/observe/dashboards), click a panel and press `Control+C`
(`Command+C` on macOS).
3. Click in the notebook text area and press `Control+V` (`Command+V` on macOS).
#### Create a panel in the notebook
1. [Open a notebook](#open-a-notebook).
2. In an empty notebook, click **Add panel**, or in any notebook open the
[command menu](#use-the-command-menu) by typing `/` and select **Panel**.
3. Configure the panel in the **Add panel** dialog, and then click **Apply**. See
[Edit a panel](/observe/dashboards/panels#edit-a-panel).
#### From Logs Explorer
1. [Open a notebook](#open-a-notebook), or leave it closed to pick a notebook when
you add content.
2. Open [Logs Explorer](/investigate/querying/query-logs) and enter a query.
**Add to notebook** is disabled until the query field contains text.
3. To match a specific chart type, select a visualization for the query results.
4. Click **Add to notebook** in the page actions.
5. If no notebook is open, select one in the **Add panel to notebook** dialog, or
click **Add to new notebook**.
Cortex XCOR adds two panels: a log volume histogram, and a panel matching
the selected visualization (such as list, table, or time series). Both use the Logs
Explorer [time range](/navigate/time-ranges).
### Save an investigation report
This feature isn't available to all Palo Alto Networks Cortex XCOR users and
might not be visible in your app. For information about enabling this feature in your
environment, contact [Cortex XCOR Support](/support).
When a [deep investigation](/navigate/assistant/capabilities#start-an-investigation)
finishes, save its report as a new notebook to share context with other responders or
keep an evidence file after the incident.
1. Open the completed investigation report from the **Investigation** card on
[alert details](/investigate/alerts/alert-details) and click **Show investigation**.
2. Open the report from an [investigation card](/navigate/assistant/interface#investigation-cards)
in the Assistant and click **View full investigation**.
3. Click **Save as notebook**.
Observability Platform creates a notebook named for the alert when that name is
available and opens it in the [notebook side panel](#notebook-side-panel). The
notebook includes context, findings, decisive evidence charts as
[panels](#add-a-panel), open questions, and suggested mitigation actions. Its default
[time range](/navigate/time-ranges) is about 30 minutes before and after the alert
incident time when that time is known.
Generative AI features can produce incorrect results, hallucinate data, and deliver
inaccurate analysis. Use generative AI features with care, and independently verify
all information produced by generative AI tools before applying it.
Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
generative AI features or responses for any uses that exceed their designed scope.
### Use the command menu
To insert content blocks from the keyboard, type `/` anywhere in the notebook text
area to open the command menu. Continue typing to filter the list by name,
description, or keyword. Use the arrow keys to move through the results, press
`Enter` to insert the selected block, and press `Esc` to close the menu.
The command menu groups the available blocks:
* **Notebook**
* **Panel** inserts a [dashboard panel](/observe/dashboards/panels).
* **Diagram** inserts a [Mermaid diagram](#add-a-mermaid-diagram).
* **Basic blocks**
* **Text** inserts a plain paragraph.
* **Heading 1**, **Heading 2**, and **Heading 3** insert section headings.
* **Bulleted list** and **Numbered list** insert lists.
* **Quote** inserts a block quotation.
* **Code block** inserts a block of code.
* **Table** inserts a table.
### Format text
Click anywhere in the notebook that isn't an added resource to add notes. Format
notes using the toolbar under the notebook title bar:
* **Bold**, **Italic**, and **Code** for inline formatting.
* **Link** to add or edit a hyperlink. In the **Add link** dialog, enter **Text**
and **Link**, and then click **Apply**.
* **Numbered list** and **Bulleted list** for lists.
When you select text, the same formatting controls display in a menu above the
selection.
To insert block-level content such as headings, lists, quotes, code blocks, and
tables, use the [command menu](#use-the-command-menu).
### Add a Mermaid diagram
Add a [Mermaid](https://mermaid.js.org/) diagram to illustrate a workflow or
relationship inline in a notebook. Cortex XCOR renders the diagram from
its source and matches your light or dark theme.
To add a diagram:
1. [Open a notebook](#open-a-notebook).
2. Click in the notebook text area, open the [command menu](#use-the-command-menu) by
typing `/`, and select **Diagram**. You can also filter the menu by typing
`mermaid`, `flowchart`, or `graph`.
3. Cortex XCOR inserts a sample diagram. Click **Edit source** and replace
the sample with your own
[Mermaid syntax](https://mermaid.js.org/intro/syntax-reference.html).
4. Click **Preview diagram** to render it.
The diagram block provides these controls:
* **Edit source** and **Preview diagram** switch between the Mermaid source and the
rendered diagram.
* ** Remove Mermaid diagram** deletes the block.
If the source contains invalid syntax, the block displays a **Failed to render Mermaid
diagram** message with the error and your source so you can correct it.
### Link to an entity
Embed a link card for a resource in one of the following ways. Click a link card to
open the resource.
#### Mention an entity
Type `@` in the notebook text area to open the **Notebook entities** search. The menu
lists your recent entities until you type. Continue typing to search by name, then
select a result to insert a link card. You can mention collections, services,
dashboards, monitors, teams, and SLOs.
#### Paste an entity link
Paste a URL copied from a resource page in Cortex XCOR to embed a link
card labeled with the resource type and name. Use this method for pages that don't
offer **Add to notebook**, such as [collections](/administer/collections/home) or
[teams](/administer/accounts-teams/teams) pages.
1. Click in the notebook text area.
2. Paste the URL with `Control+V` (`Command+V` on macOS).
Paste each URL on its own line to add multiple resource cards.
### Edit a notebook with Operator
This feature is in Early Access (EA), and might not be visible in your app. To learn
more about this program and the features it contains, see the
[Early access](/early-access) page.
[Operator](/navigate/operator) reads the notebook you have open and edits its text,
panels, and tables when you ask. Use it to summarize what you've gathered, add a chart, or
reorganize your notes while you troubleshoot.
To edit a notebook with Operator:
1. [Open a notebook](#open-a-notebook).
2. Click ** Ask Operator** in the page header, or press
A.
3. Describe the change you want. For example:
Summarize the panels in this notebook and add the summary at the top.
Operator saves notebook edits automatically. Review each change after Operator
reports it. To revert a change, use the notebook's
[version history](#view-version-history).
Operator can also find notebooks in your personal collection when you ask it
to. For more information, see
[Operator capabilities](/navigate/operator/capabilities#edit-the-open-notebook).
Generative AI features can produce incorrect results, hallucinate data, and deliver
inaccurate analysis. Use generative AI features with care, and independently verify
all information produced by generative AI tools before applying it.
Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
generative AI features or responses for any uses that exceed their designed scope.
## Delete a notebook
To delete a notebook:
* On the full-screen notebook page, click ** Notebook settings**,
and then click **Delete notebook**.
* In the [notebooks list](#view-notebooks), click the
three vertical dots icon in the notebook's row, and
then click **Delete**.
* In the side panel:
1. [Open a notebook](#open-a-notebook).
2. Click ** Select a notebook** in the notebook header.
3. Next to the notebook you want to delete, click the
three vertical dots icon and then click **Delete**.
## Customize panels in a notebook
Change panel time ranges, open the panel editor to update queries and display
options, or capture snapshots.
### Change the time range
Change the [time range](/navigate/time-ranges) for the entire notebook to shift all
panels together, or override the time range on individual panels. For example, if
there's an anomaly in a graph in your notebook, add a second copy of the panel and
change its time range to the same time last week to compare patterns.
To change the time range for the entire notebook:
1. In the notebook, click the ** time range selector** under the
format toolbar.
2. Select a time range. See [Select time ranges](/navigate/time-ranges) for preset,
custom, and calendar options.
Panels without a per-panel override use the notebook time range. Panels with an
override keep their own time until you reset them.
To override the notebook time range for one panel:
1. Hold the pointer over the panel.
2. Click the clock icon.
3. Select an available time range, or **Custom time range** to set your own.
The customized time range appears in the panel as a chip under the panel name.
To reset the time range, click the `x` in the time range [chip](/navigate#chips),
or click the clock icon and select **Use notebook time**.
### Edit panel contents
To update a panel in a notebook:
1. Click the ** Edit** icon.
2. [Edit the panel](/observe/dashboards/panels#edit-a-panel).
Not all panel editing operations are available in notebooks. For example, you
can't change the [panel type](/observe/dashboards/panels#panel-types).
### Take a snapshot
Take a snapshot of a panel to capture specific data on a longer-term, static basis.
1. Add a panel to your notebook.
2. In the selected panel, click the three
vertical dots icon.
3. Select **Capture snapshot**.
The panel updates to indicate its snapshot status by adding
** Snapshot** under the panel title.
The snapshot time range displays next to the snapshot indicator. Zooming in on a time
range updates the time range chip, and adds an `x` to the chip. Click the `x` to
return to the original snapshot.
## Related topics
- [Respond to incidents](/overview/guides/incident-response.md)
- [Navigate the Cortex XCOR interface](/navigate.md)
- [Get started with Cortex XCOR](/overview/get-started.md)
- [Troubleshooting pipelines](/ingest/pipeline/v2/build/troubleshoot.md)
- [Configure Palo Alto Networks Telemetry Pipeline using Helm](/ingest/pipeline/v2/configure/helm.md)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.
Notebook**
icon in the page header, between [pinned scope](/navigate/pinned-scopes) and search.
After the notebook opens, see [Notebook header](#notebook-header) for full-screen, create,
share, and version history controls.