Issue stitching

B.kumar873690 — Tue, 23 Jun 2026 07:27:11 GMT

Hello everyone!

can someone explain me how the issues are stitched into cases in XSIAM?
Please explain me in detail.

Re: Issue stitching

Vinothkumar_SBA — Tue, 23 Jun 2026 12:32:09 GMT

In Cortex XSIAM, the stitching of Alerts into Issues and Issues into Cases is driven by an AI/ML-based correlation engine designed to build a unified attack narrative from large-scale security telemetry. At the first level, multiple alerts are grouped into an Issue when XSIAM identifies strong relationships such as shared entities (user, endpoint, IP address, cloud resource, or identity), temporal proximity, behavioral similarity, and process causality (parent-child process relationships). This ensures that individual alerts are not treated in isolation but are instead combined into a single meaningful security story segment representing part of an attack chain.

At the next level, multiple Issues are stitched into a Case, which represents the full end-to-end security incident or attack campaign. This correlation is based on broader relationships such as common entities across issues, matching threat intelligence indicators (IOCs, malware families, attacker infrastructure), and continuity across the attack lifecycle stages like phishing, execution, persistence, lateral movement, and exfiltration. XSIAM uses its ML-driven data model and continuous telemetry enrichment to understand that these separate Issues are actually part of the same coordinated attack.

Overall, this approach transforms fragmented security data into a single unified Case, enabling SOC teams to investigate the complete attack lifecycle in one place instead of handling multiple disconnected alerts and issues. This significantly reduces alert fatigue, improves investigation efficiency, and supports faster detection and response in modern SOC environments.

Reference:

https://www.paloaltonetworks.com/cyberpedia/what-is-extended-security-intelligence-and-automation-management-xsiam

https://www.paloaltonetworks.com/resources/ebooks/cortex-xsiam

Please help other users by clicking ‘Accept as Solution’ if a post helps solve your problem.

Best Regards,

Vinothkumar C

topic Issue stitching in Cortex XSIAM Discussions

Issue stitching

Re: Issue stitching