Alerts - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

An alert is a potential security risk identified by Cortex Xpanse on your services and assets. Alerts are triggered by attack surface rules, which define the risks Xpanse is looking for and the severity assigned to those risks. Xpanse groups alerts into incidents, which are collections of alerts related to a single service or asset.

View all your alerts in a table format on the Alerts page, where you can filter, sort, and search alerts. To view the Alerts page, go to Incident Response → Alerts. Refer to the following resources for additional information:

Select an alert in the table to open the alert details page on a separate tab in your browser. The alerts details page includes most of the information you need to investigate and remediate an alert, including the owner of the related incident, service and website details, relevant asset details, and remediation guidance.

You can also view alerts in the context of an incident on the Incidents page. The Alerts tab in an incident provides detailed information about each alert in the incident.