topic Malware Scan Results Vs Alerts Created in Cortex XDR Discussions

Malware Scan Results Vs Alerts Created

Bojan-Totic — Tue, 10 Oct 2023 22:33:36 GMT

Hi,

I'm just wondering if someone can help me understand, why the results of a malware scan (i.e. 19 malicious files found) doesn't reflect the amount of alerts created. I'd assume there would be 19 malicious files as stated, with an alert for each?

As you can see in the example below, the scan yielded 19 malicious files in the results:

When I click on show alerts, it takes me to the below screenshot.. but all I see is 8 alerts about 7 files.

Should there be more alerts specific to each malicious files found? And if not, where would I ensure that all 19 files are accounted for in a trigger?

Thanks for the help in advance!

Bojan

Re: Malware Scan Results Vs Alerts Created

abdrahman — Wed, 11 Oct 2023 01:47:18 GMT

Hello @Bojan-Totic

Thank you for reaching out to the Live Community. I see in the second screenshot there is a filter applied, could you please try to change search field as host and see if you are able to see all the alerts for 19 files as seen in the first screenshot? Please let us know if this resolves our issue. Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Malware Scan Results Vs Alerts Created

PiyushKohli — Wed, 11 Oct 2023 11:13:47 GMT

Hi @Bojan-Totic

This is expected, because of deduplication period i.e. The amount of time in which additional alerts for the same activity or behavior are suppressed before Cortex XDR raises another alert and this is avoid flooding with so many alerts. Therefore in the alert triggered it shows number of time similar activity/alert triggered. As can be seen from your screenshot +4, +6 and +2.

Likewise, sharing this screenshot for reference. In this case since those 85 alerts were for the same file/activity/behavior, hence instead of triggering 85 alerts it mentions about the related alerts from the last hour.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Malware Scan Results Vs Alerts Created

Bojan-Totic — Wed, 11 Oct 2023 14:04:43 GMT

Oh okay, thank you that helps!

Do you see any pitfalls of not being able to see all referenced 19 malicious files in that moment, although they somehow share similar behavior/characteristics? My worry is essentially not getting the full picture during the response/remediation phase.

Kind Regards,

Bojan

Re: Malware Scan Results Vs Alerts Created

Bojan-Totic — Wed, 11 Oct 2023 14:12:41 GMT

Hey Abraham,

Thanks for the response. Clearing the filter and adding the host does not show all 19 files. I believe the deduplication period that Piyush mentioned makes sense!

Appreciate your time.

Kind Regards,

Bojan