Cortex XDR alert log notification delay

[RichardChou]

Hi All：

We found that the Alert notification sent by XDR was delayed in delivery.
It often took over a minute to arrive, and on one occasion it took over forty minutes for our log server to receive it.
Does anyone know how to improve this issue, or is this normal?

Richard

[nsinghvirk · Accepted solution]

Hello @RichardChou 

Thanks for reaching out on LiveCommunity!

Delay in alert notification can be due to multiple external and internal factors. A delay in alert data being sent to XDR, delay in stitching of data points by XDR, delay due to communication lag between XDR and log server, grouping timeframe window etc. To find the cause please confirm whether the delay is only in the email/syslog notification you receive or is it also that alerts are getting delayed to reach the XDR console itself?

Occasional delay can be expected due to some external factors but if the delay is consistent please open a support case to investigate the cause and rectify it.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.