Incident Tasks - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Playbook Tasks: you can view, assign an owner, complete, and set a due date for playbook tasks that require attention.

To-Do Tasks: create tasks for users to complete as part of an investigation, and which are not attached to the incident's playbook. A playbook can finish running and an incident can be closed even if the incident contains open To-Do tasks.

You can Create a To-Do Task directly from the incident Case (incident) info tab or in the To-Do Task section.

Alternatively, you can create To-Do tasks from the command line.