Incident and alert domains - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Cortex XSIAM assigns each incident and alert to a domain. Domains help you to organize and manage your work efforts, and differentiate between use cases.

Incident Domains help you to organize and manage your work efforts by associating incidents and alerts to a domain, and creating a tailored experience for each domain. Incident domains are a logical contextual boundary that allow you to manage and prioritize each operational use case, and help you to differentiate between your security use cases and non-security use cases.

When an alert is triggered, Cortex XSIAM automatically assigns it to a domain, and the same domain is assigned to the associated incident. If you create your own incident or correlation rule, you can select the domain to which you want to assign the incident or alerts.

On the Incidents and Alerts pages, you can see the domain to which your incidents and alerts are assigned. Each incident and alert is assigned to a single domain, and you cannot change the assigned domain.

Cortex XSIAM provides the following built-in domains:




For incidents and alerts that are associated with incident response activities for detecting, preventing, and blocking threats. For example, alerts that can harm the security of your organization's assets.


For incidents and alerts that are associated with operational activities for ensuring availability and reliability in system performance. For example, server outages, network connectivity issues, application performance problems, or IT tasks.


For incidents and alerts that are associated with identifying and mitigating potential security threats before they cause any damage. For example, monitoring network traffic, analyzing logs, and conducting vulnerability assessments.

You can see all domains under ConfigurationsObject SetupIncidentsDomains. From this tab you can edit the properties of the built in domains, and create your own domains for non-security use cases. For more information, see Create an incident domain.


Consider the following information:

  • You can't merge incidents with different domains, and you can't move alerts between incidents with a different domains.

  • SmartScore is currently supported for the Security domain only.

  • For SBAC, there is a new tag family for Incident Domains, and new tags for each domain that enable you to control access to your domains.

  • Domains might affect custom content that is connected to incidents and alerts. Review you custom content to ensure it is associated with the intended domains, this includes:

    • Playbook Triggers

    • Starring Rules

    • Notifications

    • Alert Exclusions

    • Scoring Rules

    • XQL that accesses the incident or alert datasets in Scheduled Queries, and Widgets