Grouping of alerts

[Shashanksinha]

Is it possible to group alerts which are not part of incident ?

Regards,

Shashank

[bbucao]

Hi Shashanksinha,

Grouping alerts that are not part of an Incident is not supported at this time. You can move alerts between incidents, or create a new incident from an alert that is already part of an incident.

Thanks,
Ben

[jcandelaria]

@Shashanksinha 

Can you be specific on the question? Typically anything medium, high and some low severity are part of an incident already.

When you open an incident, you can right click an alert (except insight) --> manage alert --> select move alert from incident --> then you have the option to "Move to Existing Incident" or "Create New Incident"

Reference on Incident:

https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/customer-success-webinar-cortex-xdr-soc-ana...