Coretex XDR alert/incidents for wildfire test file

Abdul_Razaq — Thu, 02 Jul 2020 06:06:28 GMT

Hi Community,

Does the wildfire test file generate a alert/incident which can be seen XRD console ?

I have a XDR agent connected to cloud. The wildfire test sample in prevented and i can see it in events of XDR agent. I cannot see this in XDR console neither in incident nor alert table. Does this expected behaviour ?.

Also i noticed that one of the prevention (not the test file but other .exe) is also not visible in portal. I hope each security events in agent should create at least one alert in console.

Thanks in advance.

Re: Coretex XDR alert/incidents for wildfire test file

dfalcon — Wed, 15 Jul 2020 14:25:28 GMT

Hi @Abdul_Razaq,

The test PE should not create an incident, but it should create an alert even though it is prevented. I have tested and verified this in the past. For the policy rule applied to the machine what does the malware profile specify instruction-wise?

topic Coretex XDR alert/incidents for wildfire test file in Cortex XDR Discussions

Coretex XDR alert/incidents for wildfire test file

Re: Coretex XDR alert/incidents for wildfire test file