While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
If an incident in Cortex XDR contains only alerts that have been excluded, the system will automatically mark the incident as 'Resolved – False Positive.' This process ensures that incidents generated by known and benign activities do not remain open unnecessarily, preventing confusion and reducing the workload for security analysts.
I agree it is D in the admin guide link
D - "If an incident contains only alerts with exclusions, Cortex XDR changes the incident status to Resolved - False Positive and sends an email notification to the incident assignee (if set)." Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-Alert-Exclusion-Rule