topic Re: Change in the way URL Filtering alerts are presented in Cortex XDR? in Cortex XDR Discussions

Change in the way URL Filtering alerts are presented in Cortex XDR?

KRisselada — Fri, 31 Jul 2020 16:43:17 GMT

Hello, beginning on or about 20 July, began to see MANY more Incidents created in Cortex XDR that looked similar to this:

Incident Description: 'Threat ID #' generated by PAN NGFW detected on host <hostName> involving xyz\UserName

(note, there is NOTHING after the "#" sign)

Incident Sources: PAN NGFW

When looking at the Alert that caused this Cortex Incident, what you see is:
Category: "URL Filtering"
Alert Name: "Threat ID #"

I should not that I believe BEFORE this apparent change or bug, within Cortex XDR Alerts page we would see something like this:
Category: "URL Filtering (10082)"
Alert Name: "Threat ID #9999"

Are others noticing this too?
Is this the desired / expected behavior of Cortex XDR?
It seems like there has been a CHANGE in the way Cortex presents these Alerts and Incidents

Is there knowledge and expectations its operating this way?

See attached screenshots

Re: Change in the way URL Filtering alerts are presented in Cortex XDR?

KRisselada — Fri, 31 Jul 2020 17:46:24 GMT

I should also note I find this in the Cortex XDR Pro Administrators Guide:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-endpoint-alerts/cortex-xdr-alerts

Which doesn't seem to entirely mesh with what have been seeing. Is the Guide correct or is the Production environment of Cortex correct?

Re: Change in the way URL Filtering alerts are presented in Cortex XDR?

dfalcon — Wed, 05 Aug 2020 14:20:44 GMT

Hi @KRisselada-

There very well may be adjustments to rules (analytics, bioc, etc) with each release. For the behavior you are describing, this should not be typical. In this instance, I recommend reaching out to support/TAC to allow our engineers to take a look.

Re: Change in the way URL Filtering alerts are presented in Cortex XDR?

KRisselada — Wed, 05 Aug 2020 14:46:53 GMT

thanks so much @dfalcon I did indeed create a request within the Support team and currently its been escalated to Engineering.
For those that might have / want a reference of this, its PAN Support Case 01544546. I will share here updates if applicable.

Re: Change in the way URL Filtering alerts are presented in Cortex XDR?

dfalcon — Wed, 05 Aug 2020 15:00:21 GMT

Hi @KRisselada-

I can see that Jacqueline escalated the case to engineering. I will subscribe to the case as well.