topic Re: Some Alert Exclusions don't work anymore in Cortex XDR Discussions

Some Alert Exclusions don't work anymore

RFeyertag — Fri, 20 Jan 2023 20:52:52 GMT

Hello dear community,

Since some days, my alert exclusions do not work anymore and the alerts are popping up. Now i noticed the quotes in the target process cmd.

powershell.exe -command --> before

"powershell.exe" -command --> from now

What has happened? The automation task wasn't changed, but maybe a behaviour change from PA?

Rob

Re: Some Alert Exclusions don't work anymore

neelrohit — Mon, 23 Jan 2023 08:17:05 GMT

@RFeyertag

Thank you for reaching out to live community!

Possibly there is A recalculation on your tenant for your exclusion policy. Possible that there was an edit on the policy because of an edit and there is a backwards scan running. Please check backwards scan status

Re: Some Alert Exclusions don't work anymore

RFeyertag — Mon, 23 Jan 2023 13:49:16 GMT

Hello @neelrohit,

what is an backward scan status? And why do I have to do this? Isn't there any information why this quotes suddenly appearing? And day by day I have more not working exclusions.

Rob

Re: Some Alert Exclusions don't work anymore

neelrohit — Tue, 24 Jan 2023 08:37:58 GMT

Hi @RFeyertag ,

Backwards scan is a logic which runs on the Cortex XDR console for querying past events from the date a rule has been created( IOC/BIOC) and also for alert exclusions when you want to exclude the existing alerts. If the exclusion rules were edited and checked in for exclude existing alerts, there will be a backwards scan running in. Till the time, the backwards scan is running, exclusions will not work for old alerts and only the new alerts will be excluded.

However, if you are saying that it is not working for you. I recommend opening a TAC case.