topic Re: Abnormal Recurring Communications to a Rare IP in Cortex XDR Discussions

Abnormal Recurring Communications to a Rare IP

RajeshPremSingh — Mon, 18 Nov 2024 17:12:51 GMT

We are receiving multiple alerts from the rule below. All alerts are legitimate Microsoft IPs:

Abnormal Recurring Communications to a Rare IP

Could there have been any recent changes on the Cortex end that might be triggering this?

jmazzeo — Tue, 19 Nov 2024 14:53:06 GMT

Hi @RajeshPremSingh, thanks for reaching us using the Live Community.

That's an Analytics alert which means that the connections are not usual to the destination IPs, that doesn't mean that those IPs are malicious.

If this post answers your question, please mark it as the solution.

RajeshPremSingh — Wed, 20 Nov 2024 20:33:39 GMT

Thanks for your reply. I have a few questions:

Data Sources for Alerts:
- Where is the data for the alert "Abnormal Recurring Communications to a Rare IP" coming from?
- eg :Possible sources include browsing history, cookie cache, DNS logs, etc.
Machine Learning Models:
- The alert mentions, "Based on our machine learning models, this connection was flagged as suspicious."
- How does this work since it is a new BIOC rule and is still learning?

AvesterFahimipour — Fri, 22 Nov 2024 09:13:56 GMT

They recently added this and it is making a ton of noise I would suggest tuning it out for now.