Some Alert Exclusions don't work anymore

[RFeyertag]

Hello dear community,

Since some days, my alert exclusions do not work anymore and the alerts are popping up. Now i noticed the quotes in the target process cmd.

powershell.exe -command --> before

"powershell.exe" -command --> from now

What has happened? The automation task wasn't changed, but maybe a behaviour change from PA?

BR

Rob

[neelrohit]

Hi 

@RFeyertag 

Thank you for reaching out to live community!

Possibly there is A recalculation on your tenant for your exclusion policy. Possible that there was an edit on the policy because of an edit and there is a backwards scan running. Please check backwards scan status

[RFeyertag]

Hello @neelrohit, 

what is an backward scan status? And why do I have to do this? Isn't there any information why this quotes suddenly appearing? And day by day I have more not working exclusions. 

BR

Rob

[neelrohit]

Hi @RFeyertag ,

Backwards scan is a logic which runs on the Cortex XDR console for querying past events from the date a rule has been created( IOC/BIOC) and also for alert exclusions when you want to exclude the existing alerts. If the exclusion rules were edited and checked in for exclude existing alerts, there will be a backwards scan running in. Till the time, the backwards scan is running, exclusions will not work for old alerts and only the new alerts will be excluded.

However, if you are saying that it is not working for you. I recommend opening a TAC case.