topic Re: Incident creation latency in Cortex XDR Discussions

Incident creation latency

orkhan_alibayli — Tue, 16 Jan 2024 05:30:12 GMT

Hi all,

I have seen a few cases like that in recent days:

There was an alert by name ""Failed Connections" generated by XDR Anaytics" and inside that incident there was only one alert named "Failed connections" and alert source was XDR Analytics. But problem is that, Incident created almost 24 hour after the alert was created.

Have you experienced these type of situation before?

Re: Incident creation latency

nsinghvirk — Thu, 18 Jan 2024 14:59:45 GMT

Hello @orkhan_alibayli

Thanks for reaching out on LiveCommunity!

In this case we need to check the severity of the alert. Because Analytic BIOC alerts with medium or above severity generate the incidents and however alerts with low severity not necessarily generate incidents.

Please tell us about the severity of alert and is the 24 hour period was between actual event and incident creation or between alert generation and incident generation?

Re: Incident creation latency

orkhan_alibayli — Fri, 19 Jan 2024 04:58:53 GMT

Hi @nsinghvirk

Alert was generated by XDR Analytics and severity was low. After approximately 24 hours ( may be a few hours more or less, I dont remember exact timing) incident was created which contains only this alert.

Since our SOC team monitors based on incidents , these kind of latency is problem for us.