topic Re: Causality Chain in Cortex XDR Discussions

Causality Chain

JeanPaul222 — Tue, 07 Oct 2025 12:09:40 GMT

Hello,

Can you please explain the difference between the causality chain of the 2 attached photos?
What exactly are the executions?

Re: Causality Chain

eluis — Fri, 10 Oct 2025 11:58:47 GMT

Hi @JeanPaul222

I see that in 1 pic you have executions with the causality chain corresponding to a process execution chain

The other pic is a different area of XDR information "issues and insights" here you find alerts on suspicious/malicious actions if you find the same execution there as in the previous execution pic, you might get to the same causality chain.

Those pics are from different things not to mix with each other

In the second pic we cant see what is underneath the menu that allows you to select the opening of a new card.

So I cant se if you are selecting an action that might bring you to the same execution or a different one.

Concepts:

Issues = Alerts

Insights might be the low severity alerts that dont open incidents but can be added as enrichment at the Issues and Insights area

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thank you.

Re: Causality Chain

JakubHlavizna — Wed, 19 Nov 2025 10:41:38 GMT

Hello guys,

I am dealing with something similar.

To sum up. Causality chain view can show in some cases a different view then execution tab. But, if the CGO is the same, it should show the same thing right?

In my case, If I open Causality chain view (from alert) or If I open execution tab -> expand, the view is nearly the same, just a few graphical details are different. Is it a bug? Is it expected?

Thanks