Difference between Detected and Detected (Reported)

JuanCarlosEsquivel — Sun, 19 May 2024 23:57:29 GMT

I need to know the difference between both actions seen in alerts and if it's related to profiles configuratios(Block, Report Disabled). If it's set to Report, the action will appear like Detected (Reported) because it could be blocked?

Re: Difference between Detected and Detected (Reported)

MarkK11 — Mon, 20 May 2024 08:31:26 GMT

Hi,

In the context of security profiles, the difference lies in how they handle detected threats. When set to “Report,” the action appears as “Detected (Reported)” because it could be blocked later. However, if set to “Block,” the action directly blocks the threat without reporting it. Profiles play a crucial role in defining these behaviors for various security threats.

topic Re: Difference between Detected and Detected (Reported) in Cortex XDR Discussions

Difference between Detected and Detected (Reported)

Re: Difference between Detected and Detected (Reported)