Basic Doubt - Analytics

[EMARTINS BERNARDES]

Hello everyone,

I’m configuring some features in Cortex and noticed that a few alerts are being generated by the Analytic Rules. How can I automatically create a CASE based on these alerts?

My intention is to open incidents (i.e., “Cases”) in the console.
This is meant to improve visibility and ensure proper alert monitoring.

[susekar · Accepted solution]

Hello @EMARTINS BERNARDES ,

Greetings for the day.

In Cortex XDR, Cases (referred to in the console as Incidents) are automatically created based on the Severity of the alerts generated. By default, only alerts with Medium, High, or Critical severity trigger the creation of a new Incident. Alerts with Low or Informational severity are classified as Insights and do not create standalone cases; they are only added to existing incidents if they can be correlated with higher-severity activity.

If your Analytic Rules are generating alerts that are not appearing as cases, they are likely set to Low severity. To automatically create cases for these alerts, use one of the following methods.

 

Method 1: Use Correlation Rules (Recommended)

This is the most effective way to promote a specific analytic alert to an incident. You create a custom rule that monitors for the analytic alert and generates a new alert with a higher severity.

Steps

1. Navigate to Detection > Detection Rules > Correlations.

2. Click + Add Correlation.

3. In the XQL Search section, write a query to target your specific Analytic Alert. For example:

dataset = alerts
| filter alert_source = ENUM.XDR_ANALYTICS_BIOC and alert_name = "Your Analytic Alert Name"

Use dataset = alerts to find the existing analytic triggers.

4. In the Action section, select Generate Alert.

5. Set the Severity to Medium or High. This ensures that when the rule triggers, a case is automatically created.

6. In Alerts Fields Mapping, ensure the fields are mapped correctly to maintain incident grouping logic.

 

Method 2: Use Incident Configuration (Scoring Rules)

You can override the default severity of specific alerts using Incident Scoring rules. This elevates the alert's score so it meets the threshold for incident creation.

Steps

1. Navigate to Settings > Configuration > Incident Configuration.

2. Select + Add New Rule under Incident Scoring.

3. Define the scope by filtering for your Analytic Rule (for example, by Alert Source or Alert Name).

4. Set a Manual Score or severity level that is Medium or higher.

5. Save and activate the rule. Future alerts matching this configuration will now generate incidents.

 

Important Considerations:

Immutability
Built-in Analytic Rules and Analytic BIOC rules are predefined by Palo Alto Networks. You cannot directly change their severity or incident generation logic within the rule itself.

Automation Rules
Automation Rules can modify alert fields, but they primarily apply to alerts that are already grouped into incidents. If a low-severity alert does not create an incident, it may not appear in the Create Automation Rule wizard.

Incident Creation Policy
Ensure your global Incident Creation Policy (located under Settings > Configuration > Detections > Incident Creation Policy) does not exclude the alert sources or severities you want to monitor.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar