High medium low severity

Shashanksinha — Wed, 06 Sep 2023 09:30:04 GMT

Dear Team ,

On what basis high ,medium and low severity alerts/incidents are classified on cortex XDR

Regards,

Shashank

Re: High medium low severity

nsinghvirk — Wed, 06 Sep 2023 16:04:53 GMT

Hello @Shashanksinha

Thanks for reaching out on Live Community!

The severity of an incident is govern by the severity of alerts in it. Incident will have the same severity as of the highest severity alert in it.

For the alert side, severity depends on the type of alert it is. BIOC/IOC alerts will have the severity that was configured in them when those rules were created. For alerts from 3rd party integration, the severity will be same as was forwarded by the integrated product.

You can refer to below document to see the severity of analytics alerts

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference

Unfortunately there is no consolidated document to show how the severity works for all kind of alerts.

topic Re: High medium low severity in Cortex XDR Discussions

High medium low severity

Re: High medium low severity