Cortex XDR – Automatically Resolve Alerts/Issues as "Known Issue" Using Playbook or Predefined Command

[RajeshPremSingh]

Hello Team,

We are using a Cortex XDR tenant and would like to know whether there is a supported way to automatically update an alert/issue resolution to "Known Issue" using a predefined command, automation, or playbook action.

Our goal is to avoid manual analyst intervention for alerts that have already been validated as known benign activity and automatically mark them as Resolved - Known Issue. 

Cortex XDR 

[susekar]

Hello @RajeshPremSingh ,

Greetings for the day.

Cortex XDR can automatically handle known/benign alerts in two main ways:

• Automation Rules: Match alerts based on conditions like severity, host, detection method, etc., and automatically set them to Resolved with a reason such as Known Issue, False Positive, or Security Testing.
• Playbooks: For more complex workflows, a playbook can update the alert status and add comments before resolving it.
  
  --------------------------------------------------------------------
  
  
• Alert Exclusions: For repetitive, confirmed-benign alerts, exclusions are usually better. They prevent future alerts from creating unnecessary incidents.
• Incident status: When all alerts in an incident are resolved or excluded, the parent incident is automatically moved to Auto-Resolved.

If an automation rule is not working, check the conditions, rule status, permissions, and whether the action is actually being triggered.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar