Incident starring - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

To help you focus on the most important incidents, you can star an incident. Starring incidents enables you to narrow down the scope of incidents on the Incidents page and in the Incident management dashboard. Cortex XSIAM identifies starred incidents with a purple star.

You can star incidents manually, or create an incident starring configuration. An incident starring configuration automatically categorizes and stars incidents that contain alerts with specific attributes. In a starring configuration you define attributes or assets for alerts that you want to star. If an alert matches the attributes in the starring configuration, the alert and incident containing the alert are starred. You can manage all starring configurations under Incident Response → Incident Configuration → Starred Alerts.