Decoupling an alert from an incident

[TonyGedge]

I have seen a few instances where an alert is incorrectly linked to an incident - for example, an incident might have 50 alerts from one host and only 1 from a second host, where the alerts don't appear for a common activity.  The alerts are reasonably valid, just not really related to one another.

In cases like this, I'd like to split off the "other" alerts into a separate incident.  Is there a way to do this?

Cortex XDR 

[bbarmanroy · Accepted solution]

Yes, right click the alert , Manage Alert -> Move Alert from Incident

You can then move it to a new incident or existing incident based on your preference: