topic Re: Cortex XDR - Blocked Hashes on newer systems do not show in Incidents in Cortex XDR Discussions

Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

Abdullah-Tariq — Mon, 21 Apr 2025 07:37:21 GMT

Hi,

As the name suggests we have blocked certain hashes on Cortex XDR. However when a some new system runs the blocked hash file(s), they do get blocked a prompt is also shown on the system but there is no incident on Cortex Incident tab. Why is it so and how can i get it to show in incidents?

Re: Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

Mudhireddy — Mon, 21 Apr 2025 12:03:24 GMT

When you block a hash in Cortex XDR (via Hash Control Policy or manual blocklist),

The agent blocks the file execution locally on the endpoint
A prompt appears on the endpoint (so the user knows it’s blocked)
BUT — no incident is created automatically in the console

This is by design. Cortex XDR treats hash blocking as a policy enforcement action, not necessarily as a security incident.

Unless the blocked file is associated with another detection (behavioral, exploit, malware module, etc.), it won't generate an incident just because it’s a blocked hash.

And you can create a custom BIOC to generate a Alert like

artifact.file_hash = <your_blocked_hash_value>
AND action.type = "blocked_execution"

Re: Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

Abdullah-Tariq — Tue, 22 Apr 2025 06:05:15 GMT

Thanks for explaining, i am testing out the custom BIOC.