topic Re: XDR analytics (AI/ML) model maturity in Cortex XDR Discussions

XDR analytics (AI/ML) model maturity

meanmach — Sun, 24 Mar 2024 06:56:35 GMT

As per our understanding XDR claims that they have analytics out of the box,

Though i understand XDR needs to be tuned in an Organization after which the AI/ML detection capabilities will improve

So what are all the ways we can Tune the Analytcs , ABIOC etc If we start creating Corelation or suppression rules to remove noise will the analytics aspect improve ?

Kindly let me know

Re: XDR analytics (AI/ML) model maturity

jmazzeo — Mon, 25 Mar 2024 17:39:25 GMT

Hi @meanmach, thanks for reaching us using the Live Community.

The Analytics engine requires at least 30 endpoins with the agent installed and two weeks of ingested logs to be enabled and start having a good baseline. If your logs are not only from endpoints, then the baseline will be more accurate and you will have less false positives. Here is a very interesting doc about Analytics, and you can find here another one with all the data sources supported and the alert reference.

If you find any alert that is considered an Alert for XDR but in your environment is a normal behavior, you can create Alert Exlusions with a right click on it from the Alerts view.

Or you can go to Settings - Exceptions Configuration and create a new Alert Exclusion and manually select all the parameters from the Alerts list presented on the screen. More info here.

If this post answers your question, please mark it as the solution.

Re: XDR analytics (AI/ML) model maturity

meanmach — Tue, 26 Mar 2024 08:24:03 GMT

Thanks a lot for the information provided, For second part of the question i want to reiterate my point again would creation of suppression or exclusion rules say in a span of month be able to tune the analytics ?

Re: XDR analytics (AI/ML) model maturity

meanmach — Wed, 17 Apr 2024 07:12:09 GMT

Wanted to ask a further question what if i want to see the alerts generated but dont want it to contribute towards an incident, anyway this can be acheived?