Hi, we have recently malware scanned an endpoint and upon checking the results, it appears that there were 3 malicious files on the host.
Now, I tried to right click and view related alerts on the 3 malicious files and it just shows nothing. What's weird about this is it showing MD5 hashes on External ID field. I checked those hashes via ThreatVault and VirusTotal and it doesn't give any results.
Now my question is how are we suppose to track the 3 malicious files as per malware scan when we have no idea what it is and Cortex showing not enough insight. Checking the historical incidents on this host in regards of malicious files, I only see one WildFire related incident for the past few months.
Thank you!
Hi @aaronquiamco ,
Thank you for writing to live community.
By default the Cortex XDR will generate alerts with action Detected(Scanned) whenever it scans a malicious file. As a result, you should have the alerts present there. It seems that you have a filter applied on External ID which is not clear enough to describe whether you received the alert or not. You can use the filter for endpoint name and alert action for the use case as shown below:
| Host= <Hostname> AND Alert Source= XDR Agent AND ACTION =Detected(Scanned) |
If the above still does not yield any output for you, it is probable that there is an Alert Exclusion rule created for the parameters which will exclude and suppress alerts either from the endpoint or for the scanned as an action. Example of an alert exclusion configuration could be as shown below in the image.
Hope this helps. Please mark the response as "Accept as Solution" if it answers your query.
Hello,
I really need help on this one as we have no idea where we can pull out the 3 malicious files via Malware Scan option.
I highly doubt there was alert exclusions made on the host as this is a workstation and needs to be monitored always. I have also checked alert exclusions page and there were none related to the endpoint we malware scanned.
I have checked through this:
And set additional search parameters but it still did not show anything:
Now may I ask what is the best way for us to approach this kind of scenario? We don't know if the malware scan result is a false positive or there's a legitimate malicious files on the host itself.
Thank you!
