Cortex XDR IOC Incidents Query

[Vinothkumar_SBA]

Hi Team,

We have detected several IOC incidents in the Cortex XDR console. The action status for these incidents is marked as 'detected,' but upon further investigation, we found that the internal network team had prevented these incidents in the Palo Alto firewall. Simultaneously, when we checked the Cortex XDR console's IOC incidents debug alerts, we noticed that 'action_network_success' was set to 'false.' This discrepancy raises doubts about whether 'action_network_success' being 'false' indicates prevention or detection."

[PiyushKohli · Accepted solution]

Hi @Vinothkumar_SBA 

Thank you for writing to live community!

If I understood correctly there is an IOC in XDR whose alert was generated by Alert source as XDR IOC, but those IOC were prevented by PANW firewall do you mean this? 

Since IOC was reported as Detected by Cortex XDR agent therefore action_network_success which corresponds to that alert has/had value false. 

Could you share what discrepancy you see with the Detected alert and action_network_success as false? Additionally you may also can verify NGFW event by running XQL query for preset = network_story dataset and then look for events related to that IOC Alert. Then you may check the "action_network_success" field value.

Thanks

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.