Cortex XDR: Excluding Specific AI Agent PowerShell Activity While Maintaining Blocking

[.522643]

Currently, PowerShell activity generated by an AI Agent is being detected by Cortex XDR.

After investigation, we confirmed that this activity is a false positive, as the AI Agent uses PowerShell for administrative/management purposes.

Due to our internal operational policy, we cannot use Legacy Exceptions, so we are considering using Exclusion Rules to exclude only the alerts for this activity.
(We want to maintain the blocking/protection behavior while excluding only the alerts.)

The current detection has the following Issue Name:

PowerShell Activity - 3083271452

We are considering configuring an Exclusion Rule using Issue Name and Initiator Path as the matching conditions.

However, there is no information available in the Issues menu that allows us to distinguish only the management-related activity. We need to investigate the Causality Chain in detail to identify the actual PowerShell command-line arguments used by the AI Agent.

We have the following questions and concerns:

1. What does the number 3083271452 appended to PowerShell Activity represent?
   • Is the same number always assigned to the same activity/detection logic?
   • Or can the number change depending on the detection conditions, rule version, or other factors?
2. If we configure an Exclusion Rule using Issue Name + Initiator Path, is there a possibility that other PowerShell activities executed by the same AI Agent could also be excluded?

3. In this case, we want to exclude only the legitimate PowerShell activity performed by the AI Agent while maintaining detection and blocking for other potentially malicious PowerShell activity generated by the same application.

   What would be the most appropriate conditions for configuring the Exclusion Rule to achieve this?

Our goal is to suppress only the false-positive alerts generated by the AI Agent's legitimate administrative PowerShell activity while maintaining the existing security detection and blocking/protection capabilities for actual malicious PowerShell activity.

If anyone has implemented a similar configuration or can recommend appropriate Exclusion Rule conditions for this type of scenario, we would appreciate your advice.

[marie699wood]

The number appended to the issue name is an internal identifier for that specific detection signature and can change with rule updates or conditions, so it’s not guaranteed to be stable. Using Issue Name + Initiator Path may suppress all PowerShell activity from the AI Agent, not just the benign commands. The safer approach is to base Exclusion Rules on more granular attributes such as specific command‑line arguments or causality chain details so you only filter the legitimate administrative activity while keeping detection active for other potentially malicious PowerShell executions.