How does Cortex XDR differentiate alert prioritization from incident creation?

Cortex XDR employs two distinct but related processes for managing security events. Alert prioritization involves scoring and ranking individual alerts based on severity (e.g., Low, Medium, High, Critical) and risk scores. This allows analysts to focus on the most immediate threats. Incident creation is a subsequent process where the Cortex XDR analytics engine uses causality and other correlation techniques to automatically group multiple, related alerts into a single, cohesive incident. This provides a consolidated view of an entire attack chain, reducing alert fatigue and streamlining the investigation process by adding context.