Submit a revision about false positive malware in Cortex

CJP-PALOALTO — Fri, 19 Jun 2020 12:04:19 GMT

Hi,

Before in Traps Management Services, I was able to report a false positive hash to WildFire for revision.

How can I do that in Cortex ?

Thank you.

Re: Submit a revision about false positive malware in Cortex

KRisselada — Thu, 02 Jul 2020 17:11:12 GMT

Hello @CJP-PALOALTO I find that if you open up the specific Incident, in the Key Artifacts area, there should be the file itself and then under the Threat Intelligence there is "WF Benign" or "WF Malicious" (for example) and near it an icon that allows you to click and present the Wildfire Report. From there select the icon on the top right corner of the WF Analysis Report screen and should present workflow to "Report Verdict as Incorrect". (see screenshot for details)
Hope this helps and I didn't misunderstand what you are requesting.

topic Re: Submit a revision about false positive malware in Cortex in Cortex XDR Discussions

Submit a revision about false positive malware in Cortex

Re: Submit a revision about false positive malware in Cortex