IOC Rule has been disabled - Auto Disable limit 5000 too high

[RFeyertag]

Hello dear community, 

we had a nice expierience today with a FP (IOC, IP). We got about 2000 E-Mails and there were more than 5000 alerts, so Cortex auto disabled the IOC. So far, so good. 

In our case it would have made sence to reduce the treshold to our own limit, because 5000 is too high for us. 

What can be done here?

BR

Rob

[afurze · Accepted solution]

Hi RFeyertag,

Unfortunately, this is not a configurable option within Cortex XDR at this point.