topic Re: Cortex XDR External Alert Mapping rules in Cortex XDR Discussions

Cortex XDR External Alert Mapping rules

Honza_Linhart — Thu, 21 Sep 2023 07:38:47 GMT

Hi community,

is there anybody who knows how External Alert mapping rules work in a case there is more than one of them?

Do you create an alert for every rule that was hit or is there some kind of precedence?

There is no mention in documentation.

Thank you,

Jan

Re: Cortex XDR External Alert Mapping rules

aspatil — Thu, 21 Sep 2023 10:16:58 GMT

Hello,

XDR console will automatically aggregate repeating alert, the period of time is 24 hours. Console will consider an alert as repeating if it has exact same fields.

Re: Cortex XDR External Alert Mapping rules

Honza_Linhart — Thu, 21 Sep 2023 10:22:00 GMT

Hello Aspatil,

you're right, but what is not clear to me is when are alerts created when you have multiple rules.

- Are they evaluated from top to botom like in the firewall, or are all of them evaluated at the same time?

- If they are evaluated at the same time (and based on filtering both of them are hit), are multiple alerts created?

Thank you