Creating disable prevention rule for Alerts with different sha256 but all other values were same

Kavurisowmya — Mon, 02 Dec 2024 17:06:06 GMT

We have created a disable prevention rule for a few Cortex XDR agent-blocked alerts because they were false-positive.

However, we recently received 2 new alerts with the same fields as the ones for which we created the disable prevention rule.

I only observed that the sha256 value is different for the new alerts.

So is it because of the different sha value the alerts were triggered even though there is a disable prevention rule in place without the new sha values?

Re: Creating disable prevention rule for Alerts with different sha256 but all other values were same

nar — Tue, 03 Dec 2024 09:28:33 GMT

Hi @Kavurisowmya

Thanks for your query on LC!

Yes, Change in sha256 value would be the reason for new alerts.

You may need to validate the Rule conditions defined for this rule and keep the SHA256 blank if this value is changing OR to generally allow all values.

Give it a like & mark as solution if this helped your query!

Best,

topic Creating disable prevention rule for Alerts with different sha256 but all other values were same in Cortex XDR Discussions

Creating disable prevention rule for Alerts with different sha256 but all other values were same

Re: Creating disable prevention rule for Alerts with different sha256 but all other values were same