Learn about how Cortex XDR deduplicates issues
To optimize issue management and reduce noise, Cortex XDR employs a deduplication (dedup) mechanism for specific agent-based issues.
What is deduplication?
Deduplication is the process of grouping identical security events that occur on the same endpoint within a specific timeframe. Instead of generating a new entry for every recurring instance of a threat, the system consolidates them into a single actionable issue.
Deduplication is strictly applied to issues where the issue_name contains WildFire or Local Analysis. All other issue types are processed individually and will not be deduped.
The system generates a unique fingerprint or key for each incoming issue. If the key matches an existing active issue within the timeframe, the new event is deduped. The formula is as follows:
{agent_id}_{issue_name}_{hash_id}_{action_status}_{name}_{trigger}
Key components are resolved using a specific fallback hierarchy to ensure a match even if some data is missing:
Component | Resolution Logic (Fallback Order) |
|---|---|
hash_id |
|
name |
|
action_status | Appended only if |
trigger | The prevention trigger value from |
Note
Issues are automatically excluded from deduplication if the agent_id is missing, the hash_id is missing, or the hash_id is an all-zero SHA256 string.
The deduplication window is 1 hour. This is a sliding window that starts from the ingestion of the first issue. Identical events arriving within this 60-minute buffer are suppressed; events arriving after the window expires will trigger a new issue.
How to find deduplicated issues
Deduplicated issues are often referred to as "hidden" issues because they do not appear as unique new rows in the issue table. Instead, they are aggregated into the initial "Parent" issue instance.
To identify if an issue was suppressed by the dedup logic, search for the primary issue using the following criteria within a 1-hour window before the timestamp of the expected issue:
Agent ID: Match the specific
agent_idof the endpoint.Issue Name: Look for Local Analysis Malware or WildFire Malware.
File Identification (Hash): Use the SHA256 hierarchy (Action File → Action Process → Actor Process).
File/Process Name: Match the action_file_name or relevant process name.
Action Status: Ensure the issue_action_status matches (if it was present on the event).
If you find an issue matching these criteria that occurred less than 60 minutes prior, the "missing" issue has been successfully deduped into that existing entry.