topic Re: Increasing severity for certain critical hosts or visible tagging in Cortex XDR Discussions

Increasing severity for certain critical hosts or visible tagging

C.Perez — Thu, 02 Jan 2025 16:38:57 GMT

Is there a way to make certain server hosts show as critical servers? We have a certain amount of servers we'd like any incident related to them be automatically a critical or high alert when XDR creates an incident for them. I've created say a "Critical Server" asset group and put servers in there put how do I make any incident triggered automatically become a high or critical if the server is in question? Can we modify the incident severity that is automatically created or is there a way to have XDR see a certain tag and increase severity? Also is there a way to make it obvious a certain hosts is a critical host? Right now when looking at incidents when you see assets you just see the host name but not sure if there is a way to have a tag show up like "Critical" or something besides making the incident a high/critical severity.

Re: Increasing severity for certain critical hosts or visible tagging

jmazzeo — Thu, 02 Jan 2025 17:09:45 GMT

Hi @C.Perez, thanks for reaching us using the Live Community.

You can use Incident Scoring Rules to increase the incident severity when the affected endpoint has this tag applied. See the screenshot below as an example:

If this post answers your question, please mark it as the solution.

Re: Increasing severity for certain critical hosts or visible tagging

nar — Thu, 02 Jan 2025 17:48:13 GMT

Hi @C.Perez

Adding to what @jmazzeo suggested, there is also another method to achieve this, you can make use of Automation rule that saying when you see an Incident coming from host with specific tags "Critical" to set the severity to High/Critical.

Refer - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Automation-rules

Mark it a solution if this worked for you!

Best,

Re: Increasing severity for certain critical hosts or visible tagging

C.Perez — Mon, 06 Jan 2025 14:50:55 GMT

Awesome. This method is convenient and easy to maintain. Appreciate the tip!