topic Re: A question from the Malware Pack v2 webinar: Misclassification rate in Cortex XSOAR Discussions

A question from the Malware Pack v2 webinar: Misclassification rate

rtsedaka — Wed, 07 Dec 2022 15:56:53 GMT

How do you address the extremely high misclassification rate of both file detonation (any semi-sophisticated malware won't divulge any information in a sandbox) as well as the high misclassification by Virustotal (both FP and TP)?

Note: This question was asked as part of Cortex XSOAR Customer Success Webinar: Malware Investigation & Response V2

Re: A question from the Malware Pack v2 webinar: Misclassification rate

rtsedaka — Wed, 07 Dec 2022 15:59:01 GMT

A reply by: @ssokolovich & @bkatzir

The investigation flow is not only relying on sandbox/VT information but also on additional activities that occurred in the environment, such as additional alerts, hunting queries, etc. Moreover, all this information is populated to the incident layout for the analyst to review before determining if the alert is False/True positive.