The difference between alerts that are included in an incident and those that are not

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

The difference between alerts that are included in an incident and those that are not

L1 Bithead

hello.

Please tell me about the alerts for CortexXDR.
What criteria are used to determine when an alert is included in an incident and when it is not included in an incident?
And are alerts that are not included in incidents not "threats"?

7 REPLIES 7

Let me ask one more question.
I understand that the ideal analysis is on an incident-by-incident basis, but that would mean that we would not see alerts that are not part of an incident.
Is it correct to assume that we do not see alerts that are not "threats"?

Hi @suzu1986 by that, you're referring to alerts that are not stitched to any incident (usually Low severity alerts). You should take a look at them too, and then tag them to a specific incident if your analysis leads towards the same. 

L1 Bithead

Thank you.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!