topic How to create Exclusion for a Detection: in Cortex XDR Discussions

How to create Exclusion for a Detection:

M.Mustaqeem — Fri, 28 Mar 2025 11:04:28 GMT

Hello Everyone,
I am new to Cortex and we are receiving an alert related to "vmtools.exe" on continuous basis. I would like to ask if we can create an exclusions for this alert and how?

Thank you!

Re: How to create Exclusion for a Detection:

aspatil — Fri, 28 Mar 2025 11:58:18 GMT

Hello @M.Mustaqeem ,

Can you confirm the alert name and the module which is detecting?

Re: How to create Exclusion for a Detection:

aspatil — Fri, 28 Mar 2025 12:10:00 GMT

These alerts appear to be false positives. You can create an exception for the Behavioral Threat Protection (BTP) module.
However, I recommend reaching out to Palo Alto Networks Technical Assistance Center (TAC) to have this issue investigated and corrected on the backend. If the engineering team determines the event to be a false positive and globally applicable, they may release a fix in a content update.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.