Cortex XDR can automatically handle known/benign alerts in two main ways:

Automation Rules: Match alerts based on conditions like severity, host, detection method, etc., and automatically set them to Resolved with a reason such as Known Issue, False Positive, or Security Testing.
Playbooks: For more complex workflows, a playbook can update the alert status and add comments before resolving it.

--------------------------------------------------------------------
Alert Exclusions: For repetitive, confirmed-benign alerts, exclusions are usually better. They prevent future alerts from creating unnecessary incidents.
Incident status: When all alerts in an incident are resolved or excluded, the parent incident is automatically moved to Auto-Resolved.

If an automation rule is not working, check the conditions, rule status, permissions, and whether the action is actually being triggered.

topic Re: Cortex XDR – Automatically Resolve Alerts/Issues as "Known Issue" Using Playbook or Predefined Command in Cortex XDR Discussions

Cortex XDR – Automatically Resolve Alerts/Issues as "Known Issue" Using Playbook or Predefined Command