topic Email notification content is too large; pauses/crashes Outlook 365 in Cortex XDR Discussions

Email notification content is too large; pauses/crashes Outlook 365

HNBSteven — Tue, 06 Jul 2021 17:36:42 GMT

We have deployed a proof of concept of XDR with 30+ agents. As the system is still gathering information, we have been receiving e-mail notifications from the activities its collecting. Some e-mails vary from 100KB to 7MB in size per e-mail. It's at a point that there's a significant delay (Outlook 365) browsing these messages to an annoyance. The mobile Outlook crashes attempting to view these e-mails and the desktop Outlook has significant pauses when the message is highlighted.

1. Is anyone else experiencing issues with large XDR e-mail notifications?

2. Is there a way to display the e-mail notification with a brief summary instead of the entire json content?

Re: Email notification content is too large; pauses/crashes Outlook 365

malalade — Tue, 06 Jul 2021 21:02:14 GMT

The size of the email depends on how many alerts get grouped together, and the volume of alerts notification, which is directly related to the notification filter you set.

For example, you could experience a huge volume due to low severity and NGFW alerts, depending on your environment.

You could optimize your configuration by forwarding only the critical alerts to your email. You may use a filter like alert source =! NGFW, severity = High, excluded = No.

Note: You do not lose visibility of the remaining alerts as you can login to your tenants and respond to the low severity ones.

If the size problem persists, you could modify the "Grouping Timeframe" parameter.