The fields command selects which columns appear in the query output. Displaying only relevant fields improves readability, simplifies investigations, and reduces unnecessary information in the results.

When creating a custom incident domain in Cortex XSIAM, alert grouping still applies, allowing related alerts to be combined into incidents. However, SmartScore is not applied, since it is reserved for predefined domains.

The count() aggregation function returns the total number of records in each grouped result. It is commonly used to summarize events, identify trends, and measure activity frequency.

In Kubernetes environments, Cortex XSIAM licensing is issued per node. The license is consumed when the agent is installed on a node and is automatically returned when the agent is removed or the node is deleted, ensuring accurate license utilization.