Create alert fields in a playbook - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Creating alert fields is an iterative process in which you create fields as you better understand your needs and the information available in the third-party integrations you use. You initially define alert fields after the planning stage, with mapping and classification for how the alerts will be ingested from third-party integrations into Cortex XSIAM. However, during the investigation you can also set and update alert fields using the setAlert script in a playbook task.