XDR Alerts

YilmazDincer — Wed, 11 Jan 2023 09:33:22 GMT

I want to process the alarms received by XDR. To do this, I first need to separate the incoming alarms according to their class. If I separate them according to source, I should examine them in 4 classes as "XDR IOC, XDR BIOC, XDR Agents, XDR Analytics". Does this cover them all?

And is there a source that shows the alarms brought by "XDR Agents" (for example Wildfire )?

Re: XDR Alerts

neelrohit — Wed, 11 Jan 2023 11:16:55 GMT

Hi @YilmazDincer ,

Thank you for writing to live community!

In the alerts table, we have couple of columns besides alert sources, which shows in details the categories and modules through which alerts are generated. This works best in case of XDR agent based alerts. The two columns are “Category” and “Module”.

Try viewing these two column and later use these as filter and you should be able to segregate alerts on basis of your requirements of category and modules of alerts as well.

Hope this helps!

please mark this response as “Accept as Solution” if it resolves your query.

topic Re: XDR Alerts in Cortex XDR Discussions

XDR Alerts

Re: XDR Alerts