The alert comes from XDR Analytics BIOC. To change the severity for future matching alerts, the engineer should create a similar BIOC rule with the desired High severity and disable the original Medium-severity BIOC rule.

To use a custom script in an alert layout, the script must be tagged with "general-purpose- dynamic-section", then a general purpose dynamic section is added to the layout, and finally the section settings are edited to attach the automation script. This ensures the script executes and displays results dynamically within the alert layout.

Analytics such as impossible travel depend on normalized fields. Mapping parsed custom VPN authentication logs to the XDM Authentication schema makes the data usable by analytics engines.
Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-3.x- Documentation/XDM-fields-for-mapping-authentication-events

Cloud Identity Engine must be deployed in the same region as Cortex XSIAM to ensure compliance and proper data handling. Once integrated, the ingestion can be verified by checking the pan_dss_raw dataset, which records the raw directory synchronization logs.

When incidents are merged, the War Room entries from the source incident are moved/copied into the destination incident, but the source incident's context data/custom context fields are not preserved in the destination context.
Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x- Documentation/Manage-incidents