topic Re: Modification of default scoring for Alert-->Malware--Suspicious Executable Detected in Cortex XDR Discussions

Modification of default scoring for Alert-->Malware--Suspicious Executable Detected

DuncanGM — Thu, 20 Mar 2025 13:31:23 GMT

I am looking for a way to modify the severity score for the alert in category Malware, named Suspicious Executable Detected. By default, this stamps the alert with a MEDIUM severity and therefore creates an Incident with that Severity. I would like to manage the severity level of this alert, so that it is a HIGH severity, as at MEDIUM it does not get the prioritization that I need.

Is there a way to modify the alert logic to be able to achieve this?

Re: Modification of default scoring for Alert-->Malware--Suspicious Executable Detected

jmazzeo — Thu, 20 Mar 2025 13:34:41 GMT

Hi @DuncanGM,

Yes, you can modify the Alert Severity by using an Automation Rule.

Going to Incident Response - Response - Automation, you can create a filter rule with the action to set the severity. More details in this document.

If this post answers your question, please mark it as the solution.

Re: Modification of default scoring for Alert-->Malware--Suspicious Executable Detected

DuncanGM — Thu, 20 Mar 2025 15:50:57 GMT

Many thanks, I have set that up, just need to test it now. Thank you.