When two incidents are merged in Palo Alto XSIAM, if there are conflicting field values, the values from the destination incident are retained. The custom field values from the source incident are not transferred to the destination incident's layout. The designed and only method to restore the source incident to its original state, thereby making its custom field values accessible again, is to reverse the merge action. The "Unmerge Incidents" feature specifically serves this purpose, separating the incidents back into their individual, pre-merged states.

A. Examine the incident context of the source incident: After a merge, the source incident is closed and linked. Its original, editable field data is not directly presented in the UI for examination.

C. Check the timeline view of the incident: The timeline displays alerts and events related to the threat investigation, not the administrative history of incident field metadata changes from a merge.

D. Check the War Room of the destination incident: The War Room will contain an entry auditing the merge action itself, but it does not log or display the specific field values of the source incident before the merge.

1. Palo Alto Networks Cortex XSIAM™ Administrator’s Guide (December 2023):

Section: Merge Incidents (Page 293): "When you merge incidents, in the case of a conflict, the destination incident’s fields are used." This confirms why the custom field values from the source incident would be missing from the merged incident view.

Section: Unmerge Incidents (Page 294): "You can unmerge incidents, which returns the incidents to the state they were in before they were merged." This directly supports that unmerging is the correct procedure to retrieve the original details.