topic Re: Grouping of alerts in Cortex XDR Discussions

Grouping of alerts

Shashanksinha — Mon, 13 Mar 2023 10:24:54 GMT

Is it possible to group alerts which are not part of incident ?

Regards,

Shashank

Re: Grouping of alerts

bbucao — Mon, 13 Mar 2023 14:08:14 GMT

Hi Shashanksinha,

Grouping alerts that are not part of an Incident is not supported at this time. You can move alerts between incidents, or create a new incident from an alert that is already part of an incident.

Thanks,
Ben

Re: Grouping of alerts

jcandelaria — Mon, 13 Mar 2023 15:51:17 GMT

@Shashanksinha

Can you be specific on the question? Typically anything medium, high and some low severity are part of an incident already.

When you open an incident, you can right click an alert (except insight) --> manage alert --> select move alert from incident --> then you have the option to "Move to Existing Incident" or "Create New Incident"

Reference on Incident:

https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/customer-success-webinar-cortex-xdr-soc-analysts-understanding/ta-p/488372