The primary purpose of alert grouping in Cortex XDR is to correlate and stitch together multiple, related alerts from various data sources (e.g., endpoint, network, cloud) into a single, cohesive incident. This process uses analytics and machine learning to identify causal relationships between low-confidence and high-confidence alerts. By presenting a unified view of a potential attack chain, it provides security analysts with a comprehensive context, reduces alert fatigue, and accelerates investigation and response times. This transforms a stream of disconnected alerts into a meaningful narrative of a security event.