False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR

Yonghui_Yang — Thu, 07 Aug 2025 07:43:36 GMT

Hello everyone,

I'm experiencing ongoing false positive alerts with Cortex XDR that are affecting multiple endpoints in our environment. I'm seeking guidance on how to properly address this issue.

Environment Information:

Cortex XDR Agent Version: 8.6.0.3704
Operating System: Windows 10 64-bit
Issue Scope: All endpoints in the environment

Problem Description: We're getting consistent false positive alerts for the following legitimate Windows system processes across all our Windows 10 machines:

Sihost.exe (Shell Infrastructure Host)
PhoneExperienceHost.exe
RuntimeBroker.exe
StartMenuExperienceHost.exe
backgroundTaskHost.exe
SearchApp.exe
BackgroundTransferHost.exe
TextInputHost.exe
HxTsr.exe

These alerts are occurring continuously and affecting our entire fleet of endpoints.

Questions:

Is this a known issue with Agent Version 8.6.0.3704 on Windows 10?
What's the recommended approach to create exceptions for these legitimate Windows processes?
Are there any planned updates to address these false positives?
Should I report this through official support channels as well?

Any guidance or similar experiences shared would be greatly appreciated. These false positives are creating alert fatigue and potentially masking real threats.

Thank you for your assistance.

Re: False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR

eluis — Thu, 07 Aug 2025 15:34:55 GMT

Hi Yonghui_Yang,

there can be several reasons why you get triggered those alerts.

Maybe legit executables changed name or location ?

Maybe legit execs trying to perform suspicious activity even though they were executed from original legit folder and names, but our analytics detect it as something suspicious.

2 things can be done if none of the former.

Alert Tunning so you prevent many false positive flooding. I can recommend 2 webinars even though they are a bit aged:
1. https://live.paloaltonetworks.com/t5/cortex-xdr-videos/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842/redirect_from_archived_page/true
2. https://live.paloaltonetworks.com/t5/cortex-xdr-videos/cortex-xdr-customer-success-webinar-series-part-2-alert-tuning/ta-p/588312
Automated actions as response to alerts, also called simple automation rules:
https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-simple-automation-rules/ta-p/568454
Open a TAC support case if none of the former works

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR in Cortex XDR Discussions

False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR

Re: False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR