Multiple network-related alerts produced by different detectors on the same host

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-05-10

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Day
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Alerts OR Third-Party Alerts
Detection Modules
Detector Tags	NDR Insights Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Low

Multiple alerts produced by different detectors were seen on the same host.

Execute multiple covert actions to circumvent detection.