Correct resolve types for XDR Incidents

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Correct resolve types for XDR Incidents

L0 Member

Hi All,

 

I tried to find this on PA Knowledge base but unsuccessful. Our team tries not to make exceptions/whitelisting unless absolutely needed. Therefore, I believe teaching Cortex XDR correctly on what is safe and what is not is crucial. 

 

For example when investigating successful logons from suspicious country (Low Sev Alert), if a user confirms that logon was done by them would this be closed as a 'True Positive' because XDR correctly detected alert or 'False Positive' because alert was safe. 

 

Let me know your thoughts and/or how you would go about this. 

1 ACCEPTED SOLUTION

Accepted Solutions

L5 Sessionator

Hi @reg_naidu , by definition, a True Positive is when a behavior was correctly detected after it was performed.
On the other hand, a False Positive is when a behavior that was not performed was detected.

In this case, as the behavior was benign but was incorrectly categorized as malicious, this would be a False Positive.

Do note that these are low severity Analytics alerts - you will need to take into account if the alert was due to the endpoint leveraging VPN or similar solutions that use different gateways for optimal connectivity etc. That is the reason why the severity is low.
 A low severity alert will not create an incident by itself, but will be stitched to an existing incident which would have medium/high sev alerts. You can also look at the corresponding Analytics alerts here.

View solution in original post

1 REPLY 1

L5 Sessionator

Hi @reg_naidu , by definition, a True Positive is when a behavior was correctly detected after it was performed.
On the other hand, a False Positive is when a behavior that was not performed was detected.

In this case, as the behavior was benign but was incorrectly categorized as malicious, this would be a False Positive.

Do note that these are low severity Analytics alerts - you will need to take into account if the alert was due to the endpoint leveraging VPN or similar solutions that use different gateways for optimal connectivity etc. That is the reason why the severity is low.
 A low severity alert will not create an incident by itself, but will be stitched to an existing incident which would have medium/high sev alerts. You can also look at the corresponding Analytics alerts here.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!