What happens if an alert is not grouped into an incident?

In Cortex XDR, alerts are the foundational security events detected by the system. The platform's analytics engine attempts to correlate related alerts into a single, manageable incident to provide context and reduce analyst fatigue. However, if an alert does not have any logical or causal relationship with other alerts according to the platform's grouping logic, it is not grouped. Such an alert does not disappear; it remains as an individual, standalone alert. Analysts can view, investigate, and manage these ungrouped alerts directly from the "Alerts Table" in the Cortex XDR console, ensuring complete visibility over all detected security events.