Cortex XDR Alerts not appearing in the Admin Portal under Incidents >Alerts?

[LennonC]

Hi all,

Recently we've been experiencing some alerts (which we believe to be false positives) but are unable to see these alerts in the admin portal. Is there any configuration required to generate Admin Portal alerts in the Alerts Table? Or should they all appear there by default?

We have profile configurations and I've seen the following option: -

This is by default set to Full and Disabled. Would changing this option have any impact on our Alerts populating correctly or is this unrelated to the Alerts Table?

Thanks,

Lennon

[PC-TomS]

They should all appear unless someone excluded them.  You can check for excluded alerts in settings>Exceptions Configuration>alert exclusions.

  I did that by mistake early on and it took a while to figure it out.

[LennonC]

Thanks, I've checked this and it appears we only have two exceptions, one wouldn't effect the users reporting the alerts popping up, the other might do though. The issue with the current alerts is that there's no application named, so it could be the 2nd exception we have listed.