Cortex XDR alert log notification delay

RichardChou — Fri, 29 Mar 2024 05:04:18 GMT

Hi All：

We found that the Alert notification sent by XDR was delayed in delivery.
It often took over a minute to arrive, and on one occasion it took over forty minutes for our log server to receive it.
Does anyone know how to improve this issue, or is this normal?

Richard

Re: Cortex XDR alert log notification delay

nsinghvirk — Mon, 01 Apr 2024 16:08:47 GMT

Hello @RichardChou

Thanks for reaching out on LiveCommunity!

Delay in alert notification can be due to multiple external and internal factors. A delay in alert data being sent to XDR, delay in stitching of data points by XDR, delay due to communication lag between XDR and log server, grouping timeframe window etc. To find the cause please confirm whether the delay is only in the email/syslog notification you receive or is it also that alerts are getting delayed to reach the XDR console itself?

Occasional delay can be expected due to some external factors but if the delay is consistent please open a support case to investigate the cause and rectify it.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: Cortex XDR alert log notification delay in Cortex XDR Discussions

Cortex XDR alert log notification delay

Re: Cortex XDR alert log notification delay