Incident and alert domains - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Incident Domains help you to organize and manage your work efforts by associating incidents and alerts to a domain, and creating a tailored experience for each domain. Incident domains are a logical contextual boundary that allow you to manage and prioritize each operational use case, and help you to differentiate between your security use cases and non-security use cases.

When an alert is triggered, Cortex XSIAM automatically assigns it to a domain, and the same domain is assigned to the associated incident. If you create your own incident or correlation rule, you can select the domain to which you want to assign the incident or alerts.

On the Incidents and Alerts pages, you can see the domain to which your incidents and alerts are assigned. Each incident and alert is assigned to a single domain, and you cannot change the assigned domain.

Cortex XSIAM provides the following built-in domains:

You can see all domains under Configurations → Object Setup → Incidents → Domains. From this tab you can edit the properties of the built in domains, and create your own domains for non-security use cases. For more information, see Create an incident domain.