Decoupling an alert from an incident

TonyGedge — Sun, 14 May 2023 23:21:18 GMT

I have seen a few instances where an alert is incorrectly linked to an incident - for example, an incident might have 50 alerts from one host and only 1 from a second host, where the alerts don't appear for a common activity. The alerts are reasonably valid, just not really related to one another.

In cases like this, I'd like to split off the "other" alerts into a separate incident. Is there a way to do this?

Re: Decoupling an alert from an incident

bbarmanroy — Mon, 15 May 2023 02:41:42 GMT

Yes, right click the alert , Manage Alert -> Move Alert from Incident

You can then move it to a new incident or existing incident based on your preference:

topic Re: Decoupling an alert from an incident in Cortex XDR Discussions

Decoupling an alert from an incident

Re: Decoupling an alert from an incident