Automation Rule Actions - Administrator Guide - Cortex XDR - Cortex

Automation Rule Actions - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product

Cortex XDR

License

Pro

Creation date

2024-02-26

Last date published

2024-04-21

Category

Administrator Guide

Abstract

Includes the list of actions to take when the alert condition of the automation rule is triggered for Cortex XDR.

When creating the automation rule, the action is triggered when an alert matches the condition of the automation rule.

You can configure the following types of actions:

Action	Settings
Communication	Choose one of the options to receive notifications to keep up with alerts. Send email Send Slack message Syslog forwarding—The list of servers displayed are the servers integrated with the Cortex XDR tenant.
Alert and Incident Management
Assign Incident	Assign the incident that is linked to the alert. Assign Condition (Default) Assign only to unassigned incidents Always assign Assign To—Select the person from the list to assign the incident.
Set alert status	Alert Status—Select alert status to override the present status of the alert. New Under Investigation Resolved
Set alert severity	Alert Severity—Select alert severity to override the present severity of the alert. Critical High Medium Low
Forensics
Forensics Triage	Triage Configuration Select the triage configuration from the list.Create Triage Configuration
Endpoint Response
Run endpoint script	Run the Action On. Alert initiator host—The host specified under Host of the alert from the Alerts table. Alert remote host—The host specified under Remote Host of the alert in the Alerts table. Script. Script Library Script—Select the script from the list to run on the endpoint. The scripts listed are from the Script Library. Script Timeout (Seconds)—Enter seconds for timeout. Code Snippet Script—Add commands to create a script to run on the endpoint. Script Timeout (Seconds)—Enter seconds for timeout
Isolate endpoint/Run malware scan	Run the action on. Alert initiator host—The host specified under Host of the alert from the Alerts table. Alert remote host—The host specified under Remote Host of the alert in the Alerts table.
Retrieve File	Retrieve File from. Alert initiator file—The file specified under Initiator Path of the alert from the Alerts table. Alert causality group owner path—The path specified under CGO path of the alert from the Alerts table.
Terminate Causality (CGO)	Select this option to terminate the causality chain of processes associated with the alert/s of the automation rule.
Stop processing after this rule	The current rule is the last to be processed only if triggered.