Coretex XDR alert/incidents for wildfire test file

[Abdul_Razaq]

Hi Community,

Does the wildfire test file generate a alert/incident which can be seen XRD console ?

I have a XDR agent connected to cloud. The wildfire test sample in prevented and i can see it in events of XDR agent. I cannot see this in XDR console neither in incident nor alert table. Does this expected behaviour ?.

Also i noticed that one of the prevention (not the test file but other .exe) is also not visible in portal. I hope each security events in agent should create at least one alert in console.

Thanks in advance.

[dfalcon]

Hi @Abdul_Razaq,

The test PE should not create an incident, but it should create an alert even though it is prevented.  I have tested and verified this in the past.  For the policy rule applied to the machine what does the malware profile specify instruction-wise?