Investigation and Response - Cortex XSIAM

Centralized issue resolution

Simplified issue-level remediation by centralizing all remediation actions in one place. From the Resolution tab, you can access recommended and pending actions, run playbooks, and complete manual playbook tasks, with seamless sync to the case's Resolution Center.

All licenses

Service Level Agreements (SLAs) for issue resolution

Reduce security risk and ensure accountability with SLAs for issue resolution. These SLAs ensure teams resolve critical issues within a consistent, predictable timeframe.

All licenses

MSSP support for new cases experience

Multi-tenant users can now leverage the new cases experience in parent and child tenants for improved efficiency and consistency.

All licenses

Issue exceptions

Formalize risk deferrals and align security alerts with operational constraints using issue exceptions. This feature allows you to "snooze" or exempt specific issues while maintaining oversight through documented justifications and an approval workflow.

All licenses

Integrated asset context for investigations

Provides richer investigation context by connecting asset data directly to cases and issues.

All licenses