topic Re: False Positives Microsoft Teams Large Upload in Cortex XSOAR Discussions

False Positives Microsoft Teams Large Upload

tlmarques — Thu, 23 Nov 2023 12:11:38 GMT

Hey,

I need your help.

We are receiving alerts "XDR Incident 945 - 'Large upload (generic)' generated by #XDR Analytics detected...

Basically, this appears when the user makes a call, shares documents, or shares their screen (using Microsoft Teams).

In the #XSOAR event I can see that the processname is ms-teams.exe and the destination ip is from Microsoft Azure networks

I know this is related to screen sharing because it has happened to my user/laptop.

I tried to create a pre-process rule to do autoclose....in the test... pre-process it works, in practice it doesn't.
Does this situation happen to everyone?
any suggestion??

Re: False Positives Microsoft Teams Large Upload

gyldz — Fri, 29 Dec 2023 09:14:24 GMT

Hi @tlmarques ,

Normally, preprocessing script should discard those incidents if configured properly. I need to see your script and the raw data coming from the incident to be able to help. If you are still facing the issue, please try to provide relevant part from incident data with demisto.incident() and your preprocessing script.

Re: False Positives Microsoft Teams Large Upload

tlmarques — Wed, 03 Jan 2024 15:11:24 GMT

I've found the problem... missing parameter on incoming mapper.