Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section

Venkatesh_Konar — Thu, 04 Apr 2024 16:25:44 GMT

I am facing difficult in understanding the concepts of CGO , Initiator and Target process details while Triaging alerts and Incidents.

According to Palo alto Admin guide. They have provided the below details.

CGO NAME : The name of the process that started the causality chain is based on Cortex XDR causality logic.

INITIATED BY : The name of the process that initiated an activity such as a network connection or registry change.

TARGET PROCESS NAME : The name of the process whose creation triggered the alert.

I am unable to understand the logic behind CGO . As per above data i can infer that Initiated by is root cause for the alert and Target process is the process due to which XDR alert was triggered.

Require a clarification about CGO!

Re: Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section

nsinghvirk — Mon, 08 Apr 2024 15:32:22 GMT

Hello @Venkatesh_Konar

Thanks for reaching out on LiveCommunity!

CGO is the process which XDR after its causality analysis find response for the suspicious activity. It may not be the first process or initiator process. CGO can have its parent process also. So idly in the chain of events CGO is the process which triggered suspicious behaviour.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section in Cortex XDR Discussions

Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section

Re: Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section