topic Re: Exclusion/Suppression rule Reg in Cortex XDR Discussions

Exclusion/Suppression rule Reg

meanmach — Wed, 17 Apr 2024 07:22:58 GMT

As per my understanding Suppression rule can be created for IOC/BIOC

And exclusion can be created for rest other sources

Is there a possibility to write a rule so that alerts will be generated but they wont contribute towards an incident ?

If its not possible can we write a BIOC rule in infirmational/Low mode so that alerts will be triggered ?

jmazzeo — Wed, 17 Apr 2024 15:27:09 GMT

Hi @meanmach, thanks for reaching us using the Live Community.

You can create BIOC rules with Low or Informational severity:

That should work to create the alert and not be added to an incident.

If this post answers your question, please mark it as the solution.