topic Re: Using Hash View, but no Incidents are shown related when they should in Cortex XDR Discussions

Using Hash View, but no Incidents are shown related when they should

KRisselada — Fri, 17 Jul 2020 19:05:07 GMT

Hello LIVEcommunity,

I am wondering if anyone else is using Hash View in Cortex XDR and finding that even if a Key Artifacts of a Incident lists a hash, when you view that detail in Hash View (right click on the artifact, bring up the Hash View screen) the area where one might think there would reflect a "Related Incident" is blank?

I have opened a Support case to report what seems to be a bug, but wondered if others had seen this also.

Re: Using Hash View, but no Incidents are shown related when they should

KRisselada — Tue, 21 Jul 2020 22:24:40 GMT

just a quick update to this discussion. I spoke with support and this bounced a bit around support but ended up in " Endpoint Security Support" team. They setup a quick zoom call to confirm (and also record what was being seen)
And have since escalated the question and discussion to Engineering, via a Engineering Escalation.
Will update once have additional info.

Interested if others within the LIVEcommunity also see this behavior in their Cortex instance

Re: Using Hash View, but no Incidents are shown related when they should

KRisselada — Wed, 22 Jul 2020 18:35:44 GMT

Received update on the Support case I opened and Support team had escalated to Engineering, the answer back was:

Per Engineering - The reason why the customer does not see the incident in Hash, because we are filtering and show only open incident (new/under investigation).
It is expected behavior.

So at least this is now answered.
I also asked to have a Enduser Enhancement request put in that would more clearly indicate that this Filtering is taking place on this Hash View page and if possible, even expose the ability to apply a DIFFERENT filter than the one that is being "invisibly" applied currently.