High medium low severity

[Shashanksinha]

Dear Team ,

On what basis high ,medium and low severity alerts/incidents  are  classified on cortex XDR 

Regards,

Shashank

[nsinghvirk]

Hello @Shashanksinha 

Thanks for reaching out on Live Community!

The severity of an incident is govern by the severity of alerts in it. Incident will have the same severity as of the highest severity alert in it.

For the alert side, severity depends on the type of alert it is. BIOC/IOC alerts will have the severity that was configured in them when those rules were created. For alerts from 3rd party integration, the severity will be same as was forwarded by the integrated product.

You can refer to below document to see the severity of analytics alerts

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference

Unfortunately there is no consolidated document to show how the severity works for all kind of alerts.