Predicting blocked alerts when switching Malware/Exploit modules from "Report" to "Block"

[j.gamarra]

Hi everyone,

We are currently in the process of fine-tuning our Cortex XDR tenant. At the moment, we have several modules within our Malware and Exploit security profiles set to "Report" mode.

We are planning to harden our security posture and switch these modules to "Block" mode. However, before making this change, we want to assess the potential impact on our environment to avoid disrupting legitimate operations or generating false-positive blockages.

My question is: Is there a way to analyze the alerts and incidents currently in our console to predict exactly which ones would have been blocked if those modules were already set to "Block"?

[susekar]

Hello @j.gamarra ,

Greetings for the day.

Before moving from Report to Block mode, review what Cortex XDR is currently detecting but not preventing.

• Check Incident Response → Alerts and filter for Detected/Reported actions and Not Blocked prevention status.
• Review the affected modules and causality chains to identify legitimate applications or scripts.
• Add exceptions for any known-good activity before enabling Block.
• Test the new Block policy on a small group of endpoints first.
• Monitor for about 7 days, then roll it out to the wider environment if there are no issues.Try with the less Group (The minimal endpoints).

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar