Alert to Incident

[RFeyertag]

Hey dear community, 

do I have the chance to elevate a alert to an incident? I tried allready to set the severity of an alert to critical, but nothing happened. This alert doesn't get an Incident ID. 

I thought this was possible in the past, but I can't remember if I am doing it right. 

BR

Rob

[SeanDeHarris]

May consider to Build you own BIOC rule and play around with XQL query 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BI...

[RFeyertag]

Sorry, my fail. The alert is a low alert and I need to elevate this low alert to an incident with an ID, because I need to fill in some informations. 

I know how to build BIOC rules and I know XQL a bit. 

BR

Rob

[Belhaj_a]

Maybe the Correlation Rule will do the job, 
You can use the following XQL Query to capture the targeted alerts:
dataset = alerts
| filter alert_name = "TARGETED_ALERT_NAME"

Make sure to consider enabling Alert Suppression. Also, the new alert should have a medium severity so a new incident will be opened.
From the below-mentioned ref: "Whenever the severity type is Medium or above for the alert generated, an incident is automatically opened."

Ref: Create a Correlation Rule • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documen...

[PiyushKohli]

Hi @Belhaj_a 

Good try. However just to update here "Correlations over alerts source are not allowed" hence your above approach won't help. For BIOC's as shared above by @RFeyertag one can create their own correlation rule based on the BIOC logic and thus you will have Incidents but Incident source will be correlation this time.

Hope this clarifies!

Thanks

[RFeyertag]

Hello @Belhaj_a @PiyushKohli @SeanDeHarris 

I just need to create from a normal low alert an incident. Like you have your IOCs. I need an elevation. 

What is the right way, when an alert is true positive, but there is no incident created?

BR

Rob