Configuring alerts in Cortex XDR to prevent incident generation

A.VANACKERE — Wed, 11 Dec 2024 16:37:29 GMT

Hello,

I want to configure certain NGFW alerts in Cortex XDR so that they no longer generate incidents based on criteria such as the alert name, source zone, and destination zone. I do not want to completely hide the alert with an "Alert Exclusion" because I want it to be linked to an incident for correlation with other actions. Would reducing the severity to LOW or Informational via an "Automation Rule" or other method prevent the creation of a new incident each time? If not, what would be the best approach to meet this need?

Is there a way to simply tell Cortex not to generate incidents for these specific alerts anymore?

Thank you.

Re: Configuring alerts in Cortex XDR to prevent incident generation

nsinghvirk — Wed, 25 Dec 2024 15:47:02 GMT

Hello @A.VANACKERE

Thanks for reaching out on LiveCommunity!

There is no option/mechanism by which we can tell XDR to omit a particular alert from one incident and add it to other incidents(We can move manually).Reducing the severity to low do not exclude alert from incidents.

However when we create an alert exclusion the alert will be excluded from incidents but the logs are still there in database. So apart from the particular condition that you have created for exclusion rest of the logs can be utilised by other alerts/incidents.

topic Configuring alerts in Cortex XDR to prevent incident generation in Cortex XDR Discussions

Configuring alerts in Cortex XDR to prevent incident generation

Re: Configuring alerts in Cortex XDR to prevent incident generation