You can manage alerts and view alert details from the Alerts page in Cortex XDR.
In the → → , you can manage the alerts you see and the information about each alert.
The options available can change depending on the Alert Source.
Copy Alerts
Copy an alert into memory.
You can copy an alert into memory as follows:
Copy the URL of the alert record
Copy the value for an alert field
Copy the entire row of alert record
With either option, you can paste the contents of memory into an email to send. This is helpful if you need to share or discuss a specific alert with someone. If you copy a field value, you can also easily paste it into a search or begin a query.
Create a URL for an alert record:
From the Alerts page, right-click the alert you want to send.
Select Copy alert URL.
Cortex XDR saves the URL to memory.
Paste the URL into an email or use it as needed to share the alert.
Copy a field value in an alert record:
From the Alerts page, right-click the field in the alert that you want to copy.
Select Copy text to clipboard.
Cortex XDR saves the field contents to memory.
Paste the value into an email or use it as needed to share information from the alert.
Copy the entire row of alert record
From the Alerts page, right-click on one or more alerts you want to copy.
Select Copy entire row(s).
Paste the value into an email or use it as needed to share information from the alert.
Analyze an Alert
Learn more about analyzing alerts in the Alert Panel View and the Causality View.
To help you understand the full context of an alert, Cortex XDR provides the Alert Panel view and the Causality view that enable you to quickly make a thorough analysis.
The Causality View is available for XDR agent alerts that are based on endpoint data and for alerts raised on network traffic logs that have been stitched with endpoint data.
To view the analysis:
From the Alerts page, locate the alert you want to analyze.
Click the alert and review the information in the Alert Panel view.
Right-click anywhere in the alert, and select Investigate Causality Chain.
Choose whether to open the Causality View card for an alert in a new tab or the same tab.
You can also view the causality chain over time using the Timeline view.
Review the chain of execution and available data for the process and, if available, navigate through the process tree.
Run a Playbook on an Alert
You can run or rerun a playbook on one or more alerts. If there is currently a playbook running on one or more of the selected alerts, the Run Playbook option does not appear. If a playbook is running on the alert, but has been paused (for example, waiting for a user action), you can select to rerun the playbook or select a new playbook.
Right-click one or more alerts in the or the table within an incident and select .
If the alerts have a playbook already assigned, choose or . If the playbooks do not have a playbook assigned, .
If you are not rerunning the current assigned playbook, select a playbook to run for the selected alert(s).
the playbook.
Pivot to Views
Pivot to an alert-related view.
From any listed alert you can pivot to the following alert-related views:
Open Asset View—Open the Asset View panel and view information related to the alert there.
View full endpoint details—View the full details of the endpoint to which the alert relates.
View related incident—View information about an incident related to the alert.
View Observed Behaviors—View information about observed behaviors that are related to the alert.
To pivot to any of these views:
Right-click a listed alert.
From the pop-up menu, select the view to which you want to pivot.
Create Profile Exceptions
For Agent alerts, you can create profile exceptions.
For XDR Agent alerts, you can create profile exceptions for Window processes, BTP, and JAVA deserialization alerts directly from the Alerts table.
Right-click an XDR Agent alert which has a category of Exploit and Create alert exception.
Select an Exception Scope:
Global—Apply the exception across your organization.
Profile—Apply the exception to an existing profile or click and enter a Profile Name to create a new profile.
Add the scope.
(Optional) View your profile exceptions.
Navigate to → → .
In the Profiles table, locate the OS in which you created your global or profile exception and right-click to view or edit the exception properties.
Add File Path to Malware Profile Allow List
Add file path on existing Malware profile.
Add a file path to an existing Malware profile Allow List directly from the Alerts table.
In the Alerts table, select the Initiator Path, CGO path, and/or File Path field values you want to add to your malware profile allow list.
Right-click and select Add
<path type>to malware profile allow list.In the Add
<path type>to malware profile allow list dialog, select from your existing Profiles and Modules to which you want to add the file path to the allow list.(Optional) View your Malware profile allow list.
Navigate to → → → and locate the malware profile you selected.
Right-click, select Edit Profile and locate in the Files / Folders in Allow List section the path file you added.
Retrieve Additional Alert Details
You can access additional information relating to an alert.
To easily access additional information relating to an alert:
From the Alerts page, locate the alert for which you want to retrieve information.
Right-click anywhere in the alert, and select one of the following options:
Retrieve Additional Data— Cortex XDR can provide related files and additional analysis of the memory contents when an exploit protection module raises an Alert.
Note
This option exists only when the XTH add-on is enabled.
For tenants without XTH, select Get Causlity Data to analyze additional data.
Select Retrieve alert data and analyze to retrieve alert data consisting of the memory contents at the time the alert was raised. You can also enable Cortex XDR to automatically retrieve alert data for every relevant Alert. After Cortex XDR receives the data and performs the analysis, it issues a verdict for the alert. You can monitor the retrieval and analysis progress from the Action Center (pivot to view Additional data). When the analysis is complete, it displays the verdict in the Advanced Analysis field.
Select Retrieve related files To further examine files that are involved in an alert, you can request the agent send them to the Cortex XDR tenant. If multiple files are involved, the tenant supports up to 20 files and 200MB in total size. The agent collects all requested files into one archive and includes a log in JSON format containing additional status information. When the files are successfully uploaded, you can download them from the Action Center for up to one week.
Retrieve related files—To further examine files that are involved in an alert, you can request the agent send them to the Cortex XDR tenant. If multiple files are involved, the tenant supports up to 20 files and 200MB in total size. The agent collects all requested files into one archive and includes a log in JSON format containing additional status information. When the files are successfully uploaded, you can download them from the Action Center for up to one week.
For PAN NGFW source type alerts, Download triggering packet—Download the session PCAP containing the first 100 bytes of the triggering packet directly from Cortex XDR . To access the PCAP, you can download the file from the Alerts table, Incident, or Causality view.
Navigate to → to view the retrieval status.
Download the retrieved files locally.
In the Action Center, wait for the data retrieval action to complete successfully. Then, right-click the action row and select Additional Data. From the Detailed Results view, right-click the row and select Download Files. A ZIP folder with the retrieved data is downloaded locally.
Tip
If you require assistance from Palo Alto Networks Support to investigate the alert, ensure to provide the downloaded ZIP file.
Export Alert Details to a File
You can review alert details offline by exporting alerts to a TSV file.
To archive, continue investigation offline, or parse alert details, you can export alerts to a tab-separated values (TSV) file.
From the Alerts page, adjust the filters to identify the alerts you want to export.
When you are satisfied with the results, click the download icon (
).The icon is grayed out when there are no results.
Cortex XDR exports the filtered result set to the TSV file.