Predicting blocked alerts when switching Malware/Exploit modules from "Report" to "Block"

[j.gamarra]

Hi everyone,

We are currently in the process of fine-tuning our Cortex XDR tenant. At the moment, we have several modules within our Malware and Exploit security profiles set to "Report" mode.

We are planning to harden our security posture and switch these modules to "Block" mode. However, before making this change, we want to assess the potential impact on our environment to avoid disrupting legitimate operations or generating false-positive blockages.

My question is: Is there a way to analyze the alerts and incidents currently in our console to predict exactly which ones would have been blocked if those modules were already set to "Block"?