topic Re: no alerts no incident in Cortex XDR Discussions

no alerts no incident

K.Ganiyev — Tue, 03 Dec 2024 12:08:33 GMT

Hi everyone, i have an issue. Cortex receives data from data sources (endpoints, servers etc) but i can not see alerts and incidents. My dashbord shows 0 alert and 0 incident. Who could help to me?

Re: no alerts no incident

SecNaterr — Tue, 03 Dec 2024 15:25:50 GMT

Did you perform an onboarding with Cortex support? Surly, you configured alerts within settings>configurations.

Re: no alerts no incident

MartinCimone — Tue, 03 Dec 2024 16:19:22 GMT

We have the exact same kind of behavior and everything was working fine yesterday ...

Re: no alerts no incident

K.Ganiyev — Tue, 03 Dec 2024 17:37:59 GMT

could you solve ?

Re: no alerts no incident

nar — Wed, 04 Dec 2024 06:53:51 GMT

Hi @K.Ganiyev @MartinCimone

Thanks for your query on LC!

Do you see any alert exclusions in place that may be avoiding the alerts/Incidents to populate on the table?
Refer - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Alert-Exclusions

As a test, I would suggest running a test malware pe file on any one host with CortexXDR agent installed to check if the alerts are generated locally first so you can figure out where the issue could be(Are the agents generating alerts first of all OR do we have some issue on the reporting server?)

This discussion covers this in details, please refer- https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/wildfire-test-file/td-p/531592

Give it a like & mark as solution if this helped your query!

Best,

Re: no alerts no incident

K.Ganiyev — Thu, 26 Dec 2024 11:15:42 GMT

thanks nar