Correct resolve types for XDR Incidents

[reg_naidu]

Hi All,

I tried to find this on PA Knowledge base but unsuccessful. Our team tries not to make exceptions/whitelisting unless absolutely needed. Therefore, I believe teaching Cortex XDR correctly on what is safe and what is not is crucial. 

For example when investigating successful logons from suspicious country (Low Sev Alert), if a user confirms that logon was done by them would this be closed as a 'True Positive' because XDR correctly detected alert or 'False Positive' because alert was safe. 

Let me know your thoughts and/or how you would go about this. 

[bbarmanroy · Accepted solution]

Hi @reg_naidu , by definition, a True Positive is when a behavior was correctly detected after it was performed.
On the other hand, a False Positive is when a behavior that was not performed was detected.

In this case, as the behavior was benign but was incorrectly categorized as malicious, this would be a False Positive.

Do note that these are low severity Analytics alerts - you will need to take into account if the alert was due to the endpoint leveraging VPN or similar solutions that use different gateways for optimal connectivity etc. That is the reason why the severity is low.
 A low severity alert will not create an incident by itself, but will be stitched to an existing incident which would have medium/high sev alerts. You can also look at the corresponding Analytics alerts here.