Creating disable prevention rule for Alerts with different sha256 but all other values were same

[Kavurisowmya]

We have created a disable prevention rule for a few Cortex XDR agent-blocked alerts because they were false-positive.

However, we recently received 2 new alerts with the same fields as the ones for which we created the disable prevention rule.

I only observed that the sha256 value is different for the new alerts.

So is it because of the different sha value the alerts were triggered even though there is a disable prevention rule in place without the new sha values?

[nar]

Hi @Kavurisowmya 

Thanks for your query on LC!

Yes, Change in sha256 value would be the reason for new alerts.

You may need to validate the Rule conditions defined for this rule and keep the SHA256 blank if this value is changing OR to generally allow all values.

Give it a like & mark as solution if this helped your query!

Best,