Cortex XDR - Blocked Hashes on newer systems do not show in Incidents

[Abdullah-Tariq]

Hi,

As the name suggests we have blocked certain hashes on Cortex XDR. However when a some new system runs the blocked hash file(s), they do get blocked a prompt is also shown on the system but there is no incident on Cortex Incident tab. Why is it so and how can i get it to show in incidents?

[Mudhireddy]

When you block a hash in Cortex XDR (via Hash Control Policy or manual blocklist),

• The agent blocks the file execution locally on the endpoint 

• A prompt appears on the endpoint (so the user knows it’s blocked) 

• BUT — no incident is created automatically in the console 

This is by design. Cortex XDR treats hash blocking as a policy enforcement action, not necessarily as a security incident.

Unless the blocked file is associated with another detection (behavioral, exploit, malware module, etc.), it won't generate an incident just because it’s a blocked hash.

And you can create a custom BIOC to generate a Alert like

 artifact.file_hash = <your_blocked_hash_value>
AND action.type = "blocked_execution"

[Abdullah-Tariq]

Thanks for explaining, i am testing out the custom BIOC.