https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/predicting-blocked-alerts-when-switching-malware-exploit-modules/m-p/1262826#M9519 <P data-path-to-node="4">Hi everyone,</P> <P data-path-to-node="5">We are currently in the process of fine-tuning our Cortex XDR tenant. At the moment, we have several modules within our <STRONG data-index-in-node="120" data-path-to-node="5">Malware</STRONG> and <STRONG data-index-in-node="132" data-path-to-node="5">Exploit</STRONG> security profiles set to <STRONG data-index-in-node="165" data-path-to-node="5">"Report"</STRONG> mode.</P> <P data-path-to-node="6">We are planning to harden our security posture and switch these modules to <STRONG data-index-in-node="75" data-path-to-node="6">"Block"</STRONG> mode. However, before making this change, we want to assess the potential impact on our environment to avoid disrupting legitimate operations or generating false-positive blockages.</P> <P data-path-to-node="7">My question is: <STRONG data-index-in-node="16" data-path-to-node="7">Is there a way to analyze the alerts and incidents currently in our console to predict exactly which ones <I data-index-in-node="122" data-path-to-node="7">would have been blocked</I> if those modules were already set to "Block"?</STRONG></P> Tue, 25 Aug 2026 15:41:21 GMT j.gamarra 2026-08-25T15:41:21Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/predicting-blocked-alerts-when-switching-malware-exploit-modules/m-p/1262826#M9519 <P data-path-to-node="4">Hi everyone,</P> <P data-path-to-node="5">We are currently in the process of fine-tuning our Cortex XDR tenant. At the moment, we have several modules within our <STRONG data-index-in-node="120" data-path-to-node="5">Malware</STRONG> and <STRONG data-index-in-node="132" data-path-to-node="5">Exploit</STRONG> security profiles set to <STRONG data-index-in-node="165" data-path-to-node="5">"Report"</STRONG> mode.</P> <P data-path-to-node="6">We are planning to harden our security posture and switch these modules to <STRONG data-index-in-node="75" data-path-to-node="6">"Block"</STRONG> mode. However, before making this change, we want to assess the potential impact on our environment to avoid disrupting legitimate operations or generating false-positive blockages.</P> <P data-path-to-node="7">My question is: <STRONG data-index-in-node="16" data-path-to-node="7">Is there a way to analyze the alerts and incidents currently in our console to predict exactly which ones <I data-index-in-node="122" data-path-to-node="7">would have been blocked</I> if those modules were already set to "Block"?</STRONG></P> Tue, 25 Aug 2026 15:41:21 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/predicting-blocked-alerts-when-switching-malware-exploit-modules/m-p/1262826#M9519 j.gamarra 2026-08-25T15:41:21Z