How does Cortex XDR differentiate alert prioritization from incident creation?

Alert prioritization and incident creation are distinct, sequential processes in Cortex XDR. Incident creation is the act of grouping multiple, causally-related alerts into a single manageable entity. Prioritization, on the other hand, involves scoring the resulting incident (or individual alerts) based on factors like alert severity, threat intelligence, and asset criticality. This ranking helps analysts focus their attention on the most severe threats first. Therefore, creation consolidates alerts, while prioritization ranks them for response.

B. The processes are functionally different: one is for grouping (creation) and the other is for ranking (prioritization).
C. Alerts are generated, then grouped into incidents. The resulting incidents are then scored for prioritization. The statement is logically out of order.
D. Prioritization is a core, native feature within the Cortex XDR platform itself and is not exclusive to external SOAR integrations.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Incidents". The guide explains incident creation ("groups related alerts") and separately discusses "Incident Score," which is the mechanism for prioritization based on alert severity. This demonstrates two different concepts.