topic Re: User Message on IOC trigger in Cortex XDR Discussions

User Message on IOC trigger

Abdullah-Tariq — Thu, 22 May 2025 16:52:47 GMT

Hi,

We have enabled user notifications in agent profile settings, when an event like malware detection occurs it is displayed to the user immediately. However, it does not show a notification for an IOC. Can we make a message appear for an IOC event ? Any help would be appreciated.

Regards,

Re: User Message on IOC trigger

aspatil — Tue, 27 May 2025 09:30:05 GMT

Hello @Abdullah-Tariq ,

By default, Cortex XDR does NOT display user notifications for IOC detections because IOC hits are often lower-level detections or contextual information rather than direct, actionable endpoint alerts.

IOC events typically serve as backend telemetry or alert triggers for SOC analysts rather than user-facing notifications.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: User Message on IOC trigger

PhilBenson — Mon, 30 Jun 2025 07:50:46 GMT

One possibility would be to automate the execution of a script on the endpoint? For example a python script that calls the msg * (on windows systems), perhaps something similar is available for *nix systems. For example net * "You are being very naughty, don't do that!"