Endpoint Blocked IP Addresses - visibility

[DennisHager]

We observed the cortex XDR setting "respond to malicious causality chain" in action, blocking a local IP while pentesting. A new entry appeared in the action center under "Endpoint Blocked IP Addresses".

My question is, how do we know that this action took place while analyzing an incident?
There is no info in the incident
There is no info in the alert
There is no entry under under prevented action in causality chain.

There is no timeline entry or similar.

Our customer had trouble continuing work, to connect to the target host, after we resolved the incident. Thats when we realized, XDR added the IP to the blocklist.

How do we know, that we have to unblock this IP in case of an False-Positive.

[jmazzeo · Accepted solution]

Hi @DennisHager,

You should see a "Block" icon in the causalty chain investigation card, close to the IP address.

You can create an Exception for this IP using the Legacy Agent Exceptions:

If this post answers your question, please mark it as the solution.

[DennisHager]

Thanks for the reply
I expected to see an icon like this, but there is none.
In all of the seven alerts. I might have to contact TAC for this.