What does Action: Detected (Sinkhole) really mean??

FugiYang — Tue, 26 Sep 2023 21:39:28 GMT

We received a notification with Action:Detected (Sinkhole).

What does it really mean? Did Cortex XDR blacklist it? Blocked it? I can't any information on what these Actions mean in the Administrator guide.

Re: What does Action: Detected (Sinkhole) really mean??

dbahuguna — Wed, 27 Sep 2023 06:30:36 GMT

Hi @FugiYang ,

Thank you for reaching out to Palo Alto Live Community.

With respect to your query, the Action: Detected (Sinkhole) means that cortex XDR has just detected this alert and not taking any preventive or blocked action on it.

Moreover, if this is with respect to any alert or incident with which you require more assistance or in order to investigate it further, as this is a public discussion forum my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

topic Re: What does Action: Detected (Sinkhole) really mean?? in Cortex XDR Discussions

What does Action: Detected (Sinkhole) really mean??

Re: What does Action: Detected (Sinkhole) really mean??