False Positive Issue - Multiple Windows System Processes Flagged by Cortex XDR

[Yonghui_Yang]

Hello everyone,

I'm experiencing ongoing false positive alerts with Cortex XDR that are affecting multiple endpoints in our environment. I'm seeking guidance on how to properly address this issue.

Environment Information:

• Cortex XDR Agent Version: 8.6.0.3704
• Operating System: Windows 10 64-bit
• Issue Scope: All endpoints in the environment

Problem Description: We're getting consistent false positive alerts for the following legitimate Windows system processes across all our Windows 10 machines:

• Sihost.exe (Shell Infrastructure Host)
• PhoneExperienceHost.exe
• RuntimeBroker.exe
• StartMenuExperienceHost.exe
• backgroundTaskHost.exe
• SearchApp.exe
• BackgroundTransferHost.exe
• TextInputHost.exe
• HxTsr.exe

These alerts are occurring continuously and affecting our entire fleet of endpoints.

Questions:

1. Is this a known issue with Agent Version 8.6.0.3704 on Windows 10?
2. What's the recommended approach to create exceptions for these legitimate Windows processes?
3. Are there any planned updates to address these false positives?
4. Should I report this through official support channels as well?

Any guidance or similar experiences shared would be greatly appreciated. These false positives are creating alert fatigue and potentially masking real threats.

Thank you for your assistance.

[eluis]

Hi Yonghui_Yang, 

there can be several reasons why you get triggered those alerts. 

Maybe legit executables changed name or location ? 

Maybe legit execs trying to perform suspicious activity even though they were executed from original legit folder and names, but our analytics detect it as something suspicious. 

2 things can be done if none of the former.

1.  

1. Alert Tunning so you prevent many false positive flooding. I can recommend 2 webinars even though they are a bit aged:
   1. https://live.paloaltonetworks.com/t5/cortex-xdr-videos/cortex-xdr-customer-success-webinar-series-pa...
   2. https://live.paloaltonetworks.com/t5/cortex-xdr-videos/cortex-xdr-customer-success-webinar-series-pa...
2. Automated actions as response to alerts, also called simple automation rules:
   https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-simple-automat...
3. Open a TAC support case if none of the former works

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis