IOC Rule has been disabled - Auto Disable limit 5000 too high

RFeyertag — Sat, 22 Jul 2023 18:03:19 GMT

Hello dear community,

we had a nice expierience today with a FP (IOC, IP). We got about 2000 E-Mails and there were more than 5000 alerts, so Cortex auto disabled the IOC. So far, so good.

In our case it would have made sence to reduce the treshold to our own limit, because 5000 is too high for us.

What can be done here?

Rob

Re: IOC Rule has been disabled - Auto Disable limit 5000 too high

afurze — Mon, 24 Jul 2023 13:58:33 GMT

Hi RFeyertag,

Unfortunately, this is not a configurable option within Cortex XDR at this point.

topic IOC Rule has been disabled - Auto Disable limit 5000 too high in Cortex XDR Discussions

IOC Rule has been disabled - Auto Disable limit 5000 too high

Re: IOC Rule has been disabled - Auto Disable limit 5000 too high