https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/how-to-group-related-alerts-in-xsiam-and-create-a-unique/m-p/1223269#M160 <P><SPAN>Hi dear community :):&nbsp; I have a question</SPAN></P> <P><SPAN>Several alerts are forwarding in my Cortex XSIAM system coming from Microsoft Defender, these alerts have different names but all of them are part of a unique incident in MDefender and have a unique event ID.&nbsp; I want to group them in Cortex XSIAM and create a unique incident. So, can you tell me what is the best option to group them and create a new incident that include all of these related alerts? I´ll appreciate your support. Thank you</SPAN></P> Sat, 08 Mar 2025 05:56:51 GMT IngridS 2025-03-08T05:56:51Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/how-to-group-related-alerts-in-xsiam-and-create-a-unique/m-p/1223269#M160 <P><SPAN>Hi dear community :):&nbsp; I have a question</SPAN></P> <P><SPAN>Several alerts are forwarding in my Cortex XSIAM system coming from Microsoft Defender, these alerts have different names but all of them are part of a unique incident in MDefender and have a unique event ID.&nbsp; I want to group them in Cortex XSIAM and create a unique incident. So, can you tell me what is the best option to group them and create a new incident that include all of these related alerts? I´ll appreciate your support. Thank you</SPAN></P> Sat, 08 Mar 2025 05:56:51 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/how-to-group-related-alerts-in-xsiam-and-create-a-unique/m-p/1223269#M160 IngridS 2025-03-08T05:56:51Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/how-to-group-related-alerts-in-xsiam-and-create-a-unique/m-p/1225592#M170 <P>Hi IngridS,</P> <P>&nbsp;</P> <P data-unlink="true">The alert grouping mechanism is not something that can be controlled or configured, I recommend you read this <A href="https://www.paloaltonetworks.com/blog/security-operations/smartgrouping-precision-ai-driven-investigation/" target="_self">blog post</A>&nbsp;to learn more.&nbsp; The best thing you can do is ensure that all the relevant fields are mapped by the correlation rule (host, username, IPs, etc.) to ensure the grouping engine has all the relevant data to make its decision.</P> Thu, 03 Apr 2025 14:23:34 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/how-to-group-related-alerts-in-xsiam-and-create-a-unique/m-p/1225592#M170 afurze 2025-04-03T14:23:34Z