09-26-2023 02:39 PM
We received a notification with Action:Detected (Sinkhole).
What does it really mean? Did Cortex XDR blacklist it? Blocked it? I can't any information on what these Actions mean in the Administrator guide.
09-26-2023 11:30 PM
Hi @FugiYang ,
Thank you for reaching out to Palo Alto Live Community.
With respect to your query, the Action: Detected (Sinkhole) means that cortex XDR has just detected this alert and not taking any preventive or blocked action on it.
Moreover, if this is with respect to any alert or incident with which you require more assistance or in order to investigate it further, as this is a public discussion forum my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal
Feel free to write back if you have further query.
Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
