Unified Incident View - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

For MSSP and multi-tenant administrators, the Unified Incident View provides a central location to view and perform actions on child tenants across your distributed environment. You can see a consolidated view of all incidents, easily visualize and triage the incidents in your environment, and collaborate with child users.

You can access the Unified Incident View from Incident Response → Incidents.

In the Tenant Name column you can see the name of the parent and child tenants. Use this field to filter the table and see incidents from a specific child tenant. When you investigate an incident on a child tenant Cortex XSIAM pivots into the child screen so that you can perform actions directly in the child incident, and run commands in the War Room.

In addition, you can take bulk actions across multiple tenants, such as changing the status and severity, and running playbooks. When running a playbook on an alert, you can select from the playbooks that are available in the child tenant. The Tenant Name column is also displayed on the Alerts page, and enables pivoting to the child tenant.