topic Repeated False Incidents with Unknown Verdicts in Cortex XDR Discussions

Repeated False Incidents with Unknown Verdicts

V.R800240 — Mon, 23 Jun 2025 05:32:30 GMT

Hi everyone,

I’m currently facing an issue with Cortex XDR where I regularly receive incidents flagged as suspicious,

This particular one shows:

WF (WildFire) Verdict: Unknown
VT (VirusTotal): 0/64 detections

Every week, I keep seeing similar incidents, often related to legitimate services or vendors (e.g., Tata CLiQ Luxury in this case), with no solid indication of malicious behavior. Since WildFire gives an "Unknown" verdict, I can't report it for reanalysis. And as the detection rate in VirusTotal is 0/64, there’s no strong indication of threat either.

My concerns:

Is there a better way to handle these rather than manually creating exceptions for each one?
Can we automate the trust for such low-risk alerts based on certain conditions?
Are there any best practices that can help in reducing noise from such recurring false positives?

Re: Repeated False Incidents with Unknown Verdicts

eluis — Mon, 23 Jun 2025 13:47:03 GMT

Hi V.R800240,

There has to be a reason why SF did not answer with a verdict.

Maybe there was a problem when trying to load the sample into sandbox, or sandbox could not execute the file....

Further investigations should be make so please feel free to open a TAC support case.

In the meantime you can add the hash to allow list to prevent the incidents to be opened, after TAC gives you a final solution, remember to clean your allow list from temporary hashes.

Feel free to click on like the answer if this helped you.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: Repeated False Incidents with Unknown Verdicts

V.R800240 — Tue, 24 Jun 2025 03:54:51 GMT

Ok. Thanks for the update. I'll create a TAC case.

Re: Repeated False Incidents with Unknown Verdicts

eluis — Tue, 24 Jun 2025 13:13:02 GMT

Hi again,

I could not find on our labs a case in which we have unknown verdict.

When you go to unknown verdict could you tweak it as grayware ? and then wait for a response from our analysts ?

That might work too if you have the possibility while TAC is working on this

Feel free to click on like the answer if this helped you.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis