Need a clarity about CGO , Initiator details and Target details in XDR Alerts / Incident Section

[Venkatesh_Konar]

I am facing difficult in understanding the concepts of CGO , Initiator and Target process details while Triaging alerts and Incidents.

According to Palo alto Admin guide. They have provided the below details.

CGO NAME : The name of the process that started the causality chain is based on Cortex XDR causality logic.

INITIATED BY : The name of the process that initiated an activity such as a network connection or registry change.

TARGET PROCESS NAME : The name of the process whose creation triggered the alert.

I am unable to understand the logic behind CGO . As per above data i can infer that Initiated by is root cause for the alert and Target process is the process due to which XDR alert was triggered.

Require a clarification about CGO!

Cortex XDR 

[nsinghvirk]

Hello @Venkatesh_Konar 

Thanks for reaching out on LiveCommunity!

CGO is the process which XDR after its causality analysis find response for the suspicious activity. It may not be the first process or initiator process. CGO can have its parent process also. So idly in the chain of events CGO is the process which triggered suspicious behaviour.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.