Cortex XDR Incidents new field

[LokeshKumar]

Hi all,

This is my first post here.

I had this idea/suggestion that a new field should be added on incidents page.

When we deal with multiple incidents, a necessary field will be needed for quicker decision making for an analyst.

So I wanted to suggest for field called "status" wherein the action taken on the consisted alerts is summarized.

As the action taken on an alert is categorised in two main subjects- "detected" and "prevented", It will be better to get a summary of it instead of clicking on 1 incident looking inside only to notice prevented actions have taken place.

Please share your suggestions or ideas.

[dfalcon]

Hi @LokeshKumar-

I'm happy to raise a feature request.  How would you envision the status for an incident with multiple alerts with different actions?

[LokeshKumar]

Hi David,

Thanks for the reply. PA support team did help me in raising a feature request.

Regards,

Lokesh Kumar

[dfalcon]

Sounds good.  I will try to find it and up-vote it.