Causality Group Owner (CGO) - Administrator Guide - Cortex XDR - Cortex - Security Operations

The causality chains are listed according to the CGO, also called the causality actor. The CGO is the process that is responsible for all the other processes, events, and alerts in the chain.