While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
If every alert in a Cortex XDR incident requires an exclusion, the Cortex XDR console will automatically mark the incident as 'Resolved – Auto Resolve'. This means the system acknowledges that the alerts have been addressed through exclusions, implying that no further action is needed from the analyst.
is the correct
The correct answer is not listed. The incident is marked as resolved - False Positive. This is the same question as Question 41. Like Ninya69 said: "If an incident contains only alerts with exclusions, Cortex XDR changes the incident status to Resolved - False Positive and sends an email notification to the incident assignee (if set)." Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-Alert-Exclusion-Rule"
agree with Lukinator. D ist at least "Resolved"