Abnormal Recurring Communications to a Rare IP

[RajeshPremSingh]

We are receiving multiple alerts from the rule below. All alerts are legitimate Microsoft IPs:

Abnormal Recurring Communications to a Rare IP

Could there have been any recent changes on the Cortex end that might be triggering this?
Cortex XDR 

[jmazzeo]

Hi @RajeshPremSingh, thanks for reaching us using the Live Community.

That's an Analytics alert which means that the connections are not usual to the destination IPs, that doesn't mean that those IPs are malicious.

In our Analytic Alerts Reference you can find some investigation actions for this rule (and many others if needed): https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-s...

If this post answers your question, please mark it as the solution.

[RajeshPremSingh]

Hi @jmazzeo,

Thanks for your reply. I have a few questions:

1. Data Sources for Alerts:

   • Where is the data for the alert "Abnormal Recurring Communications to a Rare IP" coming from?
   • eg :Possible sources include browsing history, cookie cache, DNS logs, etc.

2. Machine Learning Models:

   • The alert mentions, "Based on our machine learning models, this connection was flagged as suspicious."
   • How does this work since it is a new BIOC rule and is still learning?

[AvesterFahimipour]

They recently added this and it is making a ton of noise I would suggest tuning it out for now.