topic Re: The difference between alerts that are included in an incident and those that are not in Cortex XDR Discussions

The difference between alerts that are included in an incident and those that are not

suzu1986 — Mon, 03 Oct 2022 06:39:14 GMT

hello.

Please tell me about the alerts for CortexXDR.
What criteria are used to determine when an alert is included in an incident and when it is not included in an incident?
And are alerts that are not included in incidents not "threats"?

Re: The difference between alerts that are included in an incident and those that are not

bbarmanroy — Mon, 03 Oct 2022 08:35:46 GMT

Hi @suzu1986 you can refer to the documentation here:

The logic behind which alert the Cortex XDR app assigns to an incident is based on a set of rules which take into account different attributes. Examples of alert attributes include alert source, type, and time period. The app extracts a set of artifacts related to the threat event, listed in each alert, and compares it with the artifacts appearing in existing alerts in the system. Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-incidents/cortex-xdr-incidents

Re: The difference between alerts that are included in an incident and those that are not

suzu1986 — Tue, 04 Oct 2022 03:42:58 GMT

Thank you.

Can you provide any detailed literature or other information on the rules for a series of incidents?
We are having a discussion internally about whether we should monitor security on an incident-by-incident or alert-by-alert basis.

Re: The difference between alerts that are included in an incident and those that are not

bbarmanroy — Tue, 04 Oct 2022 06:11:23 GMT

Ideally, you should look at it from an overall incident perspective to begin with. The reason is what I mentioned earlier - XDR will stitch alerts that match criteria into a single incident. For example, if there's a malicious acitivity of the same nature observed across multiple hosts - each activity will trigger an alert but should be clubbed in the same incident. This allows incident responders to agree on a unified action for all those alerts, and track them within the same incident. Having them investigated in a silo-ed manner leads to the lack of contextual awareness that is critical for incident analysis.

Re: The difference between alerts that are included in an incident and those that are not

suzu1986 — Wed, 05 Oct 2022 01:14:44 GMT

It was very helpful.
Thank you.

Re: The difference between alerts that are included in an incident and those that are not

suzu1986 — Wed, 05 Oct 2022 01:27:14 GMT

Let me ask one more question.
I understand that the ideal analysis is on an incident-by-incident basis, but that would mean that we would not see alerts that are not part of an incident.
Is it correct to assume that we do not see alerts that are not "threats"?

Re: The difference between alerts that are included in an incident and those that are not

bbarmanroy — Wed, 05 Oct 2022 03:14:39 GMT

Hi @suzu1986 by that, you're referring to alerts that are not stitched to any incident (usually Low severity alerts). You should take a look at them too, and then tag them to a specific incident if your analysis leads towards the same.

Re: The difference between alerts that are included in an incident and those that are not

suzu1986 — Wed, 05 Oct 2022 03:25:18 GMT

Thank you.