Multiple network-related alerts produced by different detectors on the same host

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Day
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Alerts OR Third-Party Alerts
Detection Modules
Detector Tags	NDR Insights Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Low

Multiple alerts produced by different detectors were seen on the same host.

Execute multiple covert actions to circumvent detection.