topic Cortex XDR Incidents new field in Cortex XDR Discussions

Cortex XDR Incidents new field

LokeshKumar — Sun, 07 Jun 2020 12:49:03 GMT

Hi all,

This is my first post here.

I had this idea/suggestion that a new field should be added on incidents page.

When we deal with multiple incidents, a necessary field will be needed for quicker decision making for an analyst.

So I wanted to suggest for field called "status" wherein the action taken on the consisted alerts is summarized.

As the action taken on an alert is categorised in two main subjects- "detected" and "prevented", It will be better to get a summary of it instead of clicking on 1 incident looking inside only to notice prevented actions have taken place.

Please share your suggestions or ideas.

Re: Cortex XDR Incidents new field

dfalcon — Wed, 15 Jul 2020 14:34:01 GMT

Hi @LokeshKumar-

I'm happy to raise a feature request. How would you envision the status for an incident with multiple alerts with different actions?

Re: Cortex XDR Incidents new field

LokeshKumar — Wed, 22 Jul 2020 04:45:52 GMT

Hi David,

Thanks for the reply. PA support team did help me in raising a feature request.

Regards,

Lokesh Kumar

Re: Cortex XDR Incidents new field

dfalcon — Wed, 22 Jul 2020 18:13:26 GMT

Sounds good. I will try to find it and up-vote it.