> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Use notebooks to gather related information
> Use notebooks to gather graphs, charts, and other resources from multiple pages into one place while troubleshooting a problem.
export const AiMessageIcon = props => ;
Use *notebooks* to gather information from multiple pages in Palo Alto Networks Cortex
XCOR. When you're
troubleshooting a problem, you might need graphs, charts, and
other resources to review at the same time. Notebooks let you gather these resources
in one place for ease of review.
Accounts with the `None`
[role](/administer/accounts-teams/teams#available-roles) can open and view notebooks. To
create, edit, or delete a notebook, your account must be a member of a team with the
`Editor`, `SysAdmin`, or `User Administrator` role.
Open and edit notebooks from the list, a full-screen view, or the side panel:
* [View the notebooks list](#view-the-notebooks-list) to browse every notebook you can access.
* [Open a notebook in a full-screen view](#open-a-notebook-in-a-full-screen-view) from the
notebooks list or from a collection home page.
* Use the [notebook side panel](#notebook-side-panel) on any page to add resources without
leaving your current context.
The notebooks list and side panel edit the same notebooks, so changes you make in one
place appear in the other.
## View the notebooks list
To display the list of notebooks, in the navigation menu, select
** Notebooks**. The list fills the main window. While you're on
this page, Cortex XCOR closes the notebook side panel and disables the `N`
shortcut until you leave.
By default, the table lists notebooks in your personal collection and in
[collections](/administer/collections) you can access. Notebooks in another user's
personal collection, such as one you opened from a [shared link](#share-a-notebook),
are hidden until you turn on **Show other users' notebooks**.
Use the following controls on the notebooks list.
* **Create notebook** opens a new notebook in a full-screen view when your account can
create notebooks (see the **Note** at the top of this page). See
[Create a notebook](#create-a-notebook). The button doesn't appear on the list when
you only have view access.
* **Search notebooks** filters the list by notebook name, owner, or
[category](#set-a-notebook-category).
* **Show only my notebooks** lists only notebooks in your personal collection. While
this switch is on, **Show other users' notebooks** is hidden.
* **Show other users' notebooks** also lists notebooks in other users' personal
collections. This switch appears only when **Show only my notebooks** is off.
Each row displays the notebook **Name**, its **Owner**, **Category** (when set), the
**Date modified**, and when you **Last viewed** it. The list is sorted by **Last viewed**
by default.
The **Owner** column identifies the [collection](/administer/collections) that owns the
notebook. For a personal collection, Cortex XCOR shows the owner's email
address and avatar.
Your own personal collection is labeled **(me)**.
**Owner** also links to the collection or personal collection home page. Click a
notebook's **Name** to open it in a full-screen view.
To manage a notebook from the list, click the three
vertical dots icon in its row and select an action.
* **Copy Link** copies a [shareable URL](#share-a-notebook) for the notebook.
* **Delete** [removes the notebook](#delete-a-notebook).
### Notebooks on a collection home page
Each [collection home page](/administer/collections/home) includes a **Notebooks**
section that lists notebooks owned by that collection. Use it for a quick view of
notebooks tied to a team or feature.
**View all** on the collection home page opens the same list as
** Notebooks** in the navigation menu. Cortex XCOR
doesn't pre-filter the list to that collection. To find notebooks for one collection,
use one of the following methods on the notebooks list.
1. Enter the collection name in **Search notebooks**. Search matches notebook names,
owners, and categories.
2. Locate the collection in the **Owner** column.
Click an **Owner** link on the notebooks list to open that collection's home page.
## Open a notebook in a full-screen view
When you open a notebook from the notebooks list, it fills the page. A full-screen
notebook includes the [formatting toolbar](#format-text), a
[time range selector](#change-the-time-range), an **Editing** or **Viewing** mode
control, **Copy as Markdown**, **Snapshot all panels** (in **Editing** mode when the
notebook has panels to snapshot), ** Notebook settings**, and
** [Version history](#view-version-history)**.
The page shows the notebook **Name**, **Owner**, and **Category** (when set) under the
toolbar. In **Editing** mode, click the name to rename it inline. In **Viewing** mode,
the name is read-only.
Notebooks in your personal collection open in **Editing** mode. Notebooks owned by
another user or by a [collection](/administer/collections) open in **Viewing** mode.
Switch to **Editing** to change content, rename the notebook, or update **Collection**
in ** Notebook settings**. To
[delete](#delete-a-notebook) a notebook, use **Notebook settings**. Use the
**Notebooks** breadcrumb to return to the list.
Opening a notebook in full screen closes the [notebook side panel](#notebook-side-panel)
if it was open. Closing the full-screen notebook restores the side panel.
### Set a notebook category
To classify a notebook, open ** Notebook settings** in a
full-screen view while the notebook is in **Editing** mode. Select a **Notebook
category** and click **Save**.
* **None** removes the category.
* **Documentation**, **Investigation**, **Postmortem**, **Report**, and **Runbook**
label the notebook for filtering and display.
On the [notebooks list](#view-the-notebooks-list), categorized notebooks show a
**Category** chip in their row. In a full-screen notebook, the same chip appears next to
**Owner** when a category is set.
## Notebook side panel
The notebook side panel opens over any page in Cortex XCOR so you can gather resources
without leaving your current context. Cortex XCOR displays the last notebook you
accessed, and your open notebook stays visible as you move between pages.
### Open a notebook
Click the **Notebook** icon in the page header, between [pinned scope](/navigate/pinned-scopes)
and search, or press `N`. The notebook [side panel](#notebook-side-panel) opens on the
right side of the page. The `N` shortcut is disabled on the notebooks list and full-screen
notebook pages.
After the notebook opens, see [Notebook header](#notebook-header) for full-screen, create,
share, and version history controls. Side panel notebooks often use a
[narrow header](#notebook-header-narrow).
### Switch notebooks
To switch notebooks or find a notebook you opened recently:
1. Click ** Select a notebook** in the notebook header.
2. If needed, enter a name in **Search** or use **Show only my notebooks** and
**Show other users' notebooks**. The menu uses the same visibility switches as the
[notebooks list](#view-the-notebooks-list).
3. Click a **Name** in the table to open the selected notebook. The open notebook
is labeled **(current)**. Each row also displays **Owner**, **Last viewed**, and
row actions to **Share** or **Delete**.
### Notebook header
The top of the notebook side panel provides controls to view the notebook in a full-screen
view, open its version history, copy the notebook as Markdown, copy its URL, and create a
notebook. The next row includes the [formatting toolbar](#format-text) and an **Editing** or
**Viewing** mode control. Cortex XCOR shows these controls as separate icon
buttons or groups them in a menu, depending on the width of the notebook header row. The
layout switches at 360 pixels. When the header row is narrower than 360 pixels,
Cortex XCOR uses a narrow header. When the row is 360 pixels or wider, it uses
a wide header. Resizing the notebook panel or using a long notebook name can change the
header width and switch between layouts.
Use the tab that matches what you see:
In a narrow header, these actions are grouped in one menu.
1. Click the three vertical dots icon in the
notebook header.
2. Select an action.
* [**View full screen**](#open-a-notebook-in-a-full-screen-view)
* [**Version history**](#view-version-history)
* [**Copy as Markdown**](#copy-a-notebook-as-markdown)
* [**Snapshot all panels**](#snapshot-all-panels) (in **Editing** mode)
* [**Copy URL**](#share-a-notebook)
* [**Create notebook**](#create-a-notebook)
In a wide header, each action appears as its own icon in the notebook header.
* ** [View full screen](#open-a-notebook-in-a-full-screen-view)**
* ** [Version history](#view-version-history)**
* ** [Copy as Markdown](#copy-a-notebook-as-markdown)**
* ** [Snapshot all panels](#snapshot-all-panels)** (in **Editing** mode)
* ** [Copy URL](#share-a-notebook)**
* ** [Create notebook](#create-a-notebook)**
## Notebook ownership and sharing
Every notebook belongs to a [collection](/administer/collections). Notebooks you create
are stored in your personal collection by default. To store a notebook with a team or
feature instead, open the notebook in a full-screen view, switch to **Editing** mode if
needed, open ** Notebook settings**, and select a different
**Collection**. You can also set a **Notebook category** there. See
[Set a notebook category](#set-a-notebook-category). You can't move a notebook from a
shared collection back into a personal collection from the UI. Notebooks can't be owned
by [services](/observe/services).
Other users don't see notebooks in your personal collection unless you share a link.
When someone opens a link you share, the notebook opens in their notebook panel and
appears in their [notebooks list](#view-the-notebooks-list) after they turn on
**Show other users' notebooks** when the notebook stays in your personal collection.
Collection-owned notebooks appear on the collection's
[home page](/administer/collections/home) and in the notebooks list by default.
### Share a notebook
To share a notebook, copy its URL using one of the following controls.
* In the [notebooks list](#view-the-notebooks-list), open the row's
three vertical dots menu and click **Copy Link**.
* In the side panel, click ** Copy URL** in the notebook header. If
**Copy URL** isn't visible, click the three vertical
dots icon, and then click **Copy URL**. See [Notebook header](#notebook-header) for both
header layouts.
* In **Select a notebook**, open the row menu and click **Share**. **Share** copies the
same URL as **Copy Link** on the notebooks list.
## Use Markdown with notebooks
Copy a notebook's contents to the clipboard as Markdown, or paste Markdown into an
editable notebook. Cortex XCOR doesn't support importing or
uploading Markdown files.
### Copy a notebook as Markdown
Use the control for the notebook view:
* In a full-screen notebook, click ** Copy as Markdown** in the
toolbar.
* In a wide side panel header, click ** Copy as Markdown**.
* In a narrow side panel header, click the
three vertical dots icon, and then click
**Copy as Markdown**.
The action copies the notebook body to the clipboard. Paste the contents into a text
editor and save the file with an `.md` extension if you need a Markdown file.
The copied Markdown doesn't include the notebook name, collection, owner, version
history, or notebook-wide default time range. A panel-specific time range remains part
of that panel's definition.
### Create a notebook from Markdown
1. [Create a notebook](#create-a-notebook), or open an existing notebook that you can
edit.
2. Copy the Markdown source from your `.md` file or text editor.
3. Click where you want to add the content in the notebook body. Select existing
content first if the pasted Markdown should replace it.
4. Paste with `Control+V` (`Command+V` on macOS).
Cortex XCOR converts Markdown that contains a block element, such as a
heading, list, block quote, fenced code block, table, horizontal rule, or details block.
Markdown that contains only inline syntax might paste as literal text.
### Markdown content and round trips
Notebook content maps to Markdown in the following ways:
* Free-form content uses standard Markdown for paragraphs, headings, bold and italic
text, strike-through text, inline code, links, line breaks, lists, block quotes, code
blocks, horizontal rules, tables, and task lists. Mermaid diagrams use `mermaid` code
fences.
* Visualization panels use `chrono-VizPanel` code fences containing the panel
definition as JSON. The definition includes the queries, display options, and any
panel-specific time range. Pasting the fence restores an interactive panel that runs
its queries, preserving the fence and its JSON without modification.
* Entity link cards become standard Markdown links. Pasting a recognized Cortex XCOR
entity URL restores the link card. An entity without a supported URL becomes
plain text.
* A snapshot uses the same `chrono-VizPanel` representation and retains its snapshot
identifier, but not the captured query data. The imported panel remains a
snapshot only where that identifier is available.
Most supported content survives copying and pasting through Markdown. These structures
change during conversion:
* Merged table cells expand into individual cells, multi-paragraph cells flatten onto
one line, and column alignment normalizes.
* Images become linked alt text because notebooks don't have an image block.
* Underlined text loses its underline. Inline code retains its code formatting but
loses overlapping bold, italic, or link formatting on the same text.
* Unknown notebook content becomes its fallback text, descendant text, or an
`Unsupported notebook content` label.
* Copying Markdown to another tenant doesn't copy referenced entities, snapshots, or
query data.
## View version history
To view the history of changes for a notebook, click **Version history**. In the side
panel, if **Version history** isn't visible, click the
three vertical dots icon in the notebook header, and then click **Version history**. See
[Notebook header](#notebook-header) for both header layouts.
Click **Version history** to display a panel with two tabs:
* [**Code config**](/tooling/gitops#use-the-code-config-tool): Displays a code
representation of the selected entity as of the time of the selected revision.
* **Code diff**: Displays a Git-style diff of the most-recent change made to the
entity, in Cortex XCOR API format. To compare the selected revision to another
revision in the history, click the **Compare With** dropdown and select the
timestamp of the revision that you want to compare.
* Click **Unified** to see the diff stacked horizontally.
* Click **Split** to see changes side by side.
You can see the user, service account, or
[actor](/tooling/api-info#change-actors) which made and the method used for the
last change at the top of the list of changes.
To view a revision in the history, click any entry in the list of timestamped
revisions. The timestamps default to your local time zone.
You can view unchanged lines within the diff by clicking the **Expand X lines**
links.
For a natural language description of the differences between versions, click
**Explain what has changed**. An information box appears with a summary of the
changes. This summary can help users who are less familiar with code updates
understand changes. Use the **thumbs up** or **thumbs down** icon
to indicate whether the explanation was helpful or not.
The Version History view retains up to 500 revisions, or up to 15 months of revisions
if there are fewer than 500 revisions.
### Restore a previous version
To restore a prior version of a notebook while reviewing its version history:
1. Select the version to revert to.
2. Click **Restore to *`DATE`***, where *`DATE`* is the selected version.
3. Click **Restore**.
The notebook refreshes and displays the restored version.
## Reload an updated notebook
If Cortex XCOR detects a newer saved version of the notebook than the
one displayed while the notebook is in **Editing** mode, it displays an alert. The alert
header is **A new version of this notebook is available.**
This can happen when another user saves changes to a shared notebook you're viewing.
It can also happen when you edit the same notebook in another browser tab.
Click **Reload** to load the latest saved version.
## Recover from a save error
If Cortex XCOR can't save your latest notebook changes, an error alert displays with
the header **Your latest changes could not be saved.** The notebook switches to
**Viewing** mode so unsaved edits stop accumulating. The alert body explains that the
notebook was switched to viewing mode and includes **Try again**.
Click **Try again** to retry the save and return to **Editing** mode when the save
succeeds. The alert appears in the side panel and in a full-screen notebook.
## Create a notebook
If your personal collection has no notebooks when you open the notebook panel,
Cortex XCOR creates one automatically.
To create another notebook, use one of the following controls.
* Click **Create notebook** in the [notebooks list](#view-the-notebooks-list). The new notebook
opens in a full-screen view.
* In the side panel, click **Create notebook** in the notebook header. If
**Create notebook** isn't visible, click the three
vertical dots icon, and then click **Create notebook**. See
[Notebook header](#notebook-header) for both header layouts.
* In the side panel, click ** Select a notebook**, and then click
**Create notebook**.
A new notebook opens with a default name like **Untitled notebook ``**. To
rename it in the side panel while the notebook is in **Editing** mode, click the name.
On the full-screen page, rename inline in **Editing** mode or use
** Notebook settings**.
## Add items to your notebook
Notebooks combine dashboard-style panels, entity link cards, and free-form text. This
section describes how to [add a panel](#add-a-panel), insert blocks with the
[command menu](#use-the-command-menu), [format text](#format-text), add a
[Mermaid diagram](#add-a-mermaid-diagram), [link to an entity](#link-to-an-entity),
[Save an investigation report](#save-an-investigation-report), and
[edit a notebook with Operator](#edit-a-notebook-with-operator).
To delete an item from your notebook, click the item and then press `Delete`.
### Add a panel
Add a [dashboard panel](/observe/dashboards/panels) to a notebook in one of the
following ways.
#### From another page
From any page that shows **Add to notebook** in its panel menu, such as
[dashboards](/observe/dashboards) and
[service pages](/observe/services/service-pages):
1. Hold the pointer over the panel, and then click the
three vertical dots icon.
2. Select **Add to notebook**.
3. Select a notebook, or click **Add to new notebook**.
The panel appears at the bottom of your notebook.
#### Drag a panel from a dashboard
1. [Open a notebook](#open-a-notebook).
2. Open a [dashboard](/observe/dashboards).
3. Drag a panel by its header into the notebook. **Drop panel to add to notebook**
appears when the pointer is over the notebook.
#### Copy and paste a panel
1. [Open a notebook](#open-a-notebook).
2. On a [dashboard](/observe/dashboards), click a panel and press `Control+C`
(`Command+C` on macOS).
3. Click in the notebook text area and press `Control+V` (`Command+V` on macOS).
#### Create a panel in the notebook
1. [Open a notebook](#open-a-notebook).
2. In an empty notebook, click **Add panel**, or in any notebook open the
[command menu](#use-the-command-menu) by typing `/` and select **Panel**.
3. Configure the panel in the **Add panel** dialog, and then click **Apply**. See
[Edit a panel](/observe/dashboards/panels#edit-a-panel).
#### From Logs Explorer
1. [Open a notebook](#open-a-notebook), or leave it closed to pick a notebook when
you add content.
2. Open [Logs Explorer](/investigate/querying/query-logs) and enter a query.
**Add to notebook** is disabled until the query field contains text.
3. To match a specific chart type, select a visualization for the query results.
4. Click **Add to notebook** in the page actions.
5. If no notebook is open, select one in the **Add panel to notebook** dialog, or
click **Add to new notebook**.
Cortex XCOR adds two panels: a log volume histogram, and a panel matching
the selected visualization (such as list, table, or time series). Both use the Logs
Explorer [time range](/navigate/time-ranges).
### Save an investigation report
This feature isn't available to all Palo Alto Networks Cortex XCOR users and
might not be visible in your app. For information about enabling this feature in your
environment, contact [Cortex XCOR Support](/support).
When a [deep investigation](/navigate/assistant/capabilities#start-an-investigation)
finishes, save its report as a new notebook to share context with other responders or
keep an evidence file after the incident.
1. Open the completed investigation report from the **Investigation** card on
[alert details](/investigate/alerts/alert-details) and click **Show investigation**.
2. Open the report from an [investigation card](/navigate/assistant/interface#investigation-cards)
in the Assistant and click **View full investigation**.
3. Click **Save as notebook**.
Cortex XCOR creates a notebook named for the alert when that name is
available and opens it in the [notebook side panel](#notebook-side-panel). The
notebook includes context, findings, decisive evidence charts as
[panels](#add-a-panel), open questions, and suggested mitigation actions. Its default
[time range](/navigate/time-ranges) is about 30 minutes before and after the alert
incident time when that time is known.
Generative AI features can produce incorrect results, hallucinate data, and deliver
inaccurate analysis. Use generative AI features with care, and independently verify
all information produced by generative AI tools before applying it.
Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
generative AI features or responses for any uses that exceed their designed scope.
### Use the command menu
To insert content blocks from the keyboard, type `/` anywhere in the notebook text
area to open the command menu. Continue typing to filter the list by name,
description, or keyword. Use the arrow keys to move through the results, press
`Enter` to insert the selected block, and press `Esc` to close the menu.
The command menu groups the available blocks.
* **Notebook**
* **Panel** inserts a [dashboard panel](/observe/dashboards/panels).
* **Diagram** inserts a [Mermaid diagram](#add-a-mermaid-diagram).
* **Basic blocks**
* **Text** inserts a plain paragraph.
* **Heading 1**, **Heading 2**, and **Heading 3** insert section headings.
* **Bulleted list**, **Numbered list**, and **Task list** insert lists.
* **Quote** inserts a block quotation.
* **Code block** inserts a block of code.
* **Table** inserts a table.
* **Toggle block** inserts a collapsible section.
### Format text
Click anywhere in the notebook that isn't an added resource to add notes. Format
notes using the toolbar under the notebook title bar:
* **Bold**, **Italic**, and **Code** for inline formatting.
* **Link** to add or edit a hyperlink. In the **Add link** dialog, enter **Text**
and **Link**, and then click **Apply**.
* **Numbered list**, **Bulleted list**, and **Task list** for lists.
When you select text, the same formatting controls appear in a floating menu over the
selection.
To insert block-level content such as headings, lists, quotes, code blocks, and
tables, use the [command menu](#use-the-command-menu).
### Add a Mermaid diagram
Add a [Mermaid](https://mermaid.js.org/) diagram to illustrate a workflow or
relationship inline in a notebook. Cortex XCOR renders the diagram from
its source and matches your light or dark theme.
To add a diagram:
1. [Open a notebook](#open-a-notebook).
2. Click in the notebook text area, open the [command menu](#use-the-command-menu) by
typing `/`, and select **Diagram**. You can also filter the menu by typing
`mermaid`, `flowchart`, or `graph`.
3. Cortex XCOR inserts a sample diagram. Click **Edit source** and replace
the sample with your own
[Mermaid syntax](https://mermaid.js.org/intro/syntax-reference.html).
4. Click **Preview diagram** to render it.
The diagram block provides the following controls:
* **Edit source** and **Preview diagram** switch between the Mermaid source and the
rendered diagram.
* ** Remove Mermaid diagram** deletes the block.
If the source contains invalid syntax, the block displays a **Failed to render Mermaid
diagram** message with the error and your source so you can correct it.
### Link to an entity
Embed a link card for a resource in one of the following ways. Click a link card to
open the resource.
#### Mention an entity
Type `@` in the notebook text area to open the **Notebook entities** search. The menu
lists your recent entities until you type. Continue typing to search by name, then
select a result to insert a link card. You can mention collections, services,
dashboards, monitors, teams, and SLOs.
#### Paste an entity link
Paste a URL copied from a resource page in Cortex XCOR to embed a link
card labeled with the resource type and name. Use this method for pages that don't
offer **Add to notebook**, such as [collections](/administer/collections/home) or
[teams](/administer/accounts-teams/teams) pages.
1. Click in the notebook text area.
2. Paste the URL with `Control+V` (`Command+V` on macOS).
Paste each URL on its own line to add multiple resource cards.
### Edit a notebook with Operator
This feature is in Early Access (EA), and might not be visible in your app. To learn
more about this program and the features it contains, see the
[Early access](/early-access) page.
[Operator](/navigate/operator) reads the notebook you have open and edits its text,
panels, and tables when you ask. Use it to summarize what you've gathered, add a chart, or
reorganize your notes while you troubleshoot.
To edit a notebook with Operator:
1. [Open a notebook](#open-a-notebook).
2. Click ** Ask Operator** in the page header, or press
A.
3. Describe the change you want. For example:
Summarize the panels in this notebook and add the summary at the top.
Operator saves notebook edits automatically. Review each change after Operator
reports it. To revert a change, use the notebook's
[version history](#view-version-history).
Operator can also find notebooks in your personal collection when you ask it
to. For more information, see
[Operator capabilities](/navigate/operator/capabilities#edit-the-open-notebook).
Generative AI features can produce incorrect results, hallucinate data, and deliver
inaccurate analysis. Use generative AI features with care, and independently verify
all information produced by generative AI tools before applying it.
Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
generative AI features or responses for any uses that exceed their designed scope.
## Delete a notebook
To delete a notebook:
* On the full-screen notebook page, click ** Notebook settings**,
and then click **Delete notebook**.
* In the [notebooks list](#view-the-notebooks-list), click the
three vertical dots icon in the notebook's row, and
then click **Delete**. The list always shows **Delete**. The server rejects the action
if your account doesn't have permission to edit notebooks.
* In the side panel:
1. [Open a notebook](#open-a-notebook).
2. Click ** Select a notebook** in the notebook header.
3. Next to the notebook you want to delete, click the
three vertical dots icon and then click **Delete**.
## Customize panels in a notebook
Change panel time ranges, open the panel editor to update queries and display
options, or capture snapshots.
### Change the time range
Change the [time range](/navigate/time-ranges) for the entire notebook to shift all
panels together, or override the time range on individual panels. For example, if
there's an anomaly in a graph in your notebook, add a second copy of the panel and
change its time range to the same time last week to compare patterns.
To change the time range for the entire notebook:
1. In the notebook, click the ** time range selector** under the
format toolbar.
2. Select a time range. See [Select time ranges](/navigate/time-ranges) for preset,
custom, and calendar options.
Panels without a per-panel override use the notebook time range. Panels with an
override keep their own time until you reset them.
To override the notebook time range for one panel:
1. Hold the pointer over the panel.
2. Click the clock icon.
3. Select an available time range, or **Custom time range** to set your own.
The customized time range appears in the panel as a chip under the panel name.
To reset the time range, click the `x` in the time range [chip](/navigate#chips),
or click the clock icon and select **Use notebook time**.
### Edit panel contents
To update a panel in a notebook:
1. Click the ** Edit** icon.
2. [Edit the panel](/observe/dashboards/panels#edit-a-panel).
Not all panel editing operations are available in notebooks. For example, you
can't change the [panel type](/observe/dashboards/panels#panel-types).
### Take a snapshot
Take a snapshot of a panel to capture specific data on a longer-term, static basis.
1. Add a panel to your notebook.
2. In the selected panel, click the three
vertical dots icon.
3. Select **Capture snapshot**.
The panel updates to indicate its snapshot status by adding
** Snapshot** under the panel title.
The snapshot time range displays next to the snapshot indicator. Zooming in on a time
range updates the time range chip, and adds an `x` to the chip. Click the `x` to
return to the original snapshot.
### Snapshot all panels
While a notebook is in **Editing** mode, capture snapshots for every panel at once.
In a full-screen notebook, click ** Snapshot all panels** in the
toolbar. The control is disabled when the notebook has no panels to snapshot.
In the [side panel](#notebook-side-panel), use **Snapshot all panels** in the
[notebook header](#notebook-header). In a narrow header, it appears in the
three vertical dots menu.
Cortex XCOR prompts **Snapshot all panels?** and explains that it snapshots current
data for every panel for each panel's current time range. Click **Snapshot all panels**
to confirm or **Cancel** to close the dialog without changes.
## Related topics
- [Respond to incidents](/overview/guides/incident-response.md)
- [Navigate the Cortex XCOR interface](/navigate.md)
- [Troubleshooting pipelines](/ingest/pipeline/v2/build/troubleshoot.md)
- [Get started with Cortex XCOR](/overview/get-started.md)
- [Configure Palo Alto Networks Telemetry Pipeline using Helm](/ingest/pipeline/v2/configure/helm.md)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.