About chukaokonkwo

Hi @chukaokonkwo, the identity of the user that resolved the incident can be references in the Incident Timeline tab of the incident(s) in question. You may also consider to filter the Management Audit logs as well. The following is an example filter:  Type = Incident Management AND Subtype Contains Change Incident Status AND Description Contains Resolved. ... View more

Thanks @KanwarSingh01  !!! it all adds up  ... View more

Yep we currently have over 2100 "Allowed" hashes (growing 300+ a month) and had to drag our dev team kicking and screaming to sign every tiny little application across the entire environment. And still get about 700 LC alerts a week.  ... View more

Hi @chukaokonkwo What I'd advise you is to create a Starred Alert Configuration using Featured Fields.   You can create a list of Featured Fields (link: here) using hostname, IP address, or username. Create a Starring Configuration (link here) with the featured fields.   That'll star all incidents containing alerts of this nature. Populate the hosts and save the filter for quick retrieval for future use.     Create a Scoring Rule (link here) for Featured fields as well.    Create a Notifications Rule in the Configurations to forward all alerts that meet those criteria.       ... View more

You are welcome, @chukaokonkwo!  😁   ... View more

Hi Chukaokonkwo,   I'm not sure whats your reasonable price range but if you want to, you can engaged with professional services offering below with your account team.. https://www.paloaltonetworks.com/resources/datasheets/service-description-optimization-service-for-cortex-xdr   ... View more