Overview of the Alerts page - Administrator Guide - Cortex XSIAM - Cortex

Overview of the Alerts page - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-13

Types of alerts

The Alerts page displays the following:

Security alerts: Alerts related to incident response activities for detecting, preventing, and blocking threats.
Security alerts identify threats to system integrity. For example, alerts that can harm the security of your organization's assets. These alerts are associated with the Security Domain. By default, the Alerts page displays all security alerts. If you are using a different table filter, select the Security Domain to display security alerts.
Health alerts: Alerts related to data health in Cortex XSIAM.
Health alerts identify threats to data integrity in Cortex XSIAM. For example, disruptions in data ingestion and connectivity errors in collectors. Health alerts are associated with the Health Domain. To view health alerts on the Alerts page, select the Health Domain table filter. For more information, see About health alerts.

Saved table views

On the Alerts page you can change the displayed information by changing the table view. When you open the alerts view, the Security Domain table view is displayed. Click the displayed table view to see your predefined and custom table views. You can create custom table views from scratch, or by editing the predefined options. For more information, see Saved table views.

Standardized format of user names in alerts

Cortex XSIAM processes and displays the names of users in the following standardized format, also termed “normalized user”.

<company domain>\<username>

As a result, any alert triggered based on network, authentication, or login events displays the User Name in the standardized format in the Alerts and Incidents pages. This impacts every alert for Cortex XSIAM Analytics and Cortex XSIAM Analytics BIOC, including BIOC, and IOC alerts triggered on one of these event types.

Featured fields

You can highlight alerts that are important to you by tagging speciﬁc alert attributes, such as host names, user names, IP addresses, and Active Directory, as featured fields. This can help you track alerts in the Alerts table. For more information, see Create a featured alert field.

Alert field descriptions

The following table describes both the default fields and additional optional fields that you can add to the alerts table using the column manager. This table describes the fields that are relevant for security alerts. For more information about the health alerts fields, see About health alerts.

Field

Description

Status Indicator (

)

Identifies whether there is enough endpoint data to analyze an alert.

Check box to select one or more alerts on which to perform actions. Select multiple alerts to assign all selected alerts to an analyst, or to change the status or severity of all selected alerts.

ACTION

Action taken by the alert sensor, either Detected or Prevented with action status displayed in parenthesis. Options are:

AGENT OS SUB TYPE

Operating system subtype of the agent from which the alert was triggered.

ALERT ID

Unique identifier that Cortex XSIAM assigns to each alert.

ALERT DOMAIN

Domain to which the alert is assigned.

Out-of-the-box alerts are automatically assigned to a domain. Custom alerts and correlations are assigned to a domain during creation.

ALERT NAME

Module that triggered the alert. Alerts that match an alert starring policy also display a purple star.

ALERT SOURCE

Source of the alert.

APP-ID

Related App-ID for an alert. App-ID is a traffic classification system that determines what an application is irrespective of port, protocol, encryption (SSH or SSL) or any other evasive tactic used by the application. When known, you can also pivot to the Palo Alto Networks Applipedia entry that describes the detected application.

APP CATEGORY

APP-ID category name associated with a firewall alert.

APP SUBCATEGORY

APP-ID subcategory name associated with a firewall alert.

APP TECHNOLOGY

APP-ID technology name associated with a firewall alert.

Note

Cortex XSIAM can display both the O (Organization) value and the CN (Common Name).

CLOUD IDENTITY TYPE

Classification is used to map the identity type that initiated an operation that triggered an alert. For example, Service, Application, and Temporary Credentials.

CLOUD IDENTITY SUB-TYPE

Specific classification of the identity initiated the operation. For example, for Identity Type: Temporary Credentials the subtype could be Assumed Role.

CLOUD OPERATION TYPE

Represents what has happened because of the identity operation. For example, Create, Delete, and Modify.

CLOUD PROJECT

Represents the cloud provider folders or projects. For example, AWS Accounts and Azure Subscriptions.

CLOUD PROVIDER

Name of the cloud provider where the alert occurred.

CLOUD REFERENCED RESOURCE

Represents the resources that are referenced in the alert log. In most cases, the referred resource will be where the operation was initiated on.

CLOUD RESOURCE TYPE

Classifications are used to map similar types of resources across different cloud providers. For example, EC2, Google Compute Engine, and Microsoft Compute are all mapped to Compute.

CLOUD RESOURCE SUB-TYPE

Specific classification is used to map the types of resources. For example, DISK, VPC, and Subnet are all mapped to Compute.

CONTAINS FEATURED HOST

Whether the alert includes a host name that has been flagged as a Featured Alert Field.

CONTAINS FEATURED USER

Whether the alert includes a user name that has been flagged as a Featured Alert Field.

CONTAINS FEATURED IP ADDRESS

Whether the alert includes an IP address name that has been flagged as a Featured Alert Field.

CID

Unique identifier of the causality instance generated by Cortex XSIAM .

DESCRIPTION

Text summary of the event including the alert source, alert name, severity, and file path.

DESTINATION ZONE NAME

Destination zone of the connection for firewall alerts.

DNS Query Name

Domain name is queried in the DNS request.

DOMAIN

Domain on which an alert was triggered.

EMAIL RECIPIENT

Email recipient value of a firewall alerts triggered on the content of a malicious email.

EMAIL SENDER

Email sender value of a firewall alerts triggered on the content of a malicious email.

EMAIL SUBJECT

Email subject value of a firewall alerts triggered on the content of a malicious email.

EVENT TYPE

Type of event on which the alert was triggered.

EXCLUDED

Whether the alert is excluded by an exclusion configuration.

EXTERNAL ID

Alert ID as recorded in the detector from which this alert was sent.

FILE PATH

Path to the file on the endpoint, for alerts that are triggered on a file (the Event Type is File).

FILE MACRO SHA256

SHA256 hash value of a Microsoft Office file macro.

FILE MD5

MD5 hash value of the file.

FILE SHA256

SHA256 hash value of the file.

FW NAME

Name of firewall on which a firewall alert was raised.

FW RULE ID

Firewall rule ID that triggered the firewall alert.

FW RULE NAME

Firewall rule name that matches the network traffic that triggered the firewall alert.

FW SERIAL NUMBER

Serial number of the firewall that raised the firewall alert.

HOST

Hostname of the endpoint or server on which this alert was triggered. The hostname is generally available for XDR agent alerts or alerts that are stitched with EDR data. When the hostname is unknown, this field is blank.

HOST FQDN

Fully qualified domain name (FQDN) of the Windows endpoint or server on which this alert was triggered.

HOST IP

IP address of the endpoint or server on which this alert was triggered.

HOST IPv6

IPv6 address of the endpoint or server on which this alert was triggered.

HOST MAC ADDRESS

MAC address of the endpoint or server on which this alert was triggered.

HOST OS

Operating system of the endpoint or server on which this alert was triggered.

INCIDENT ID

ID of any incident that includes the alert.

INITIATED BY

Name of the process that initiated an activity such as a network connection or registry change.

INITIATOR MD5

MD5 value of the process which initiated the alert.

INITIATOR SHA256

SHA256 hash value of the initiator.

INITIATOR CMD

Command-line used to initiate the process including any arguments.

INITIATOR SIGNATURE

Signing status of the process that initiated the activity.

INITIATOR PATH

Path of the initiating process.

INITIATOR PID

Process ID (PID) of the initiating process.

INITIATOR SIGNER

Signer of the process that triggered the alert.

Note

Cortex XSIAM can display both the O (Organization) value and the CN (Common Name).

INITIATOR TID

Thread ID (TID) of the initiating process.

IS PHISHING

Whether a firewall alert is classified as phishing.

LOCAL IP

IP address of the host that triggered the alert, for alerts that are triggered on network activity (the Event Type is Network Connection).

LOCAL PORT

Port on the endpoint that triggered the alert, for alerts that are triggered on network activity (the Event Type is Network Connection).

MAC ADDRESS

MAC address on which the alert was triggered.

MISC

Miscellaneous information about the alert.

MITRE ATT&CK TACTIC

Type of MITRE ATT&CK tactic on which the alert was triggered.

MITRE ATT&CK TECHNIQUE

Type of MITRE ATT&CK technique and sub‑technique on which the alert was triggered.

MODULE

For Cortex XDR agent alerts, this field identifies the protection module that triggered the alert.

NGFW VSYS NAME

Name of the virtual system for the Palo Alto Networks firewall that triggered an alert.

OS PARENT CREATED BY

Name of the parent operating system that created the alert.

OS PARENT CMD

Command line used by the parent operating system to initiate the process including any arguments.

OS PARENT SIGNATURE

Signing status of the operating system of the activity.

OS PARENT SIGNER

Parent operating system signer.

Note

Cortex XSIAM can display both the O (Organization) value and the CN (Common Name).

OS PARENT SH256

Parent operating system SHA256 hash value.

OS PARENT ID

Parent operating system ID.

OS PARENT PID

OS parent process ID.

OS PARENT TID

OS parent thread ID.

OS PARENT USER NAME

Name of the user associated with the parent operating system.

PHONE NUMBER

Shows the phone number that triggered the alert. This is the number that sent a malicious URL/spam or was blocked.

PROCESS EXECUTION SIGNATURE

Signature status of the process that triggered the alert.

PROCESS EXECUTION SIGNER

Signer of the process that triggered the alert.

Note

Cortex XSIAM can display both the O (Organization) value and the CN (Common Name).

REGISTRY DATA

Registry data that triggered the alert, for alerts that are triggered on registry modifications (the Event Type is Registry).

REGISTRY FULL KEY

Full registry key that triggered the alert, for alerts that are triggered on registry modifications (the Event Type is Registry).

REMOTE HOST

Remote host name that triggered the alert, for alerts that are triggered on network activity (the Event Type is Network Connection).

REMOTE IP

Remote IP address of a network operation that triggered the alert.

REMOTE PORT

Remote port of a network operation that triggered the alert.

RESOLUTION STATUS

Status that was assigned to this alert when it was triggered (or modified). Right-click an alert to change the status. If you set the status to Resolved, select a resolution reason.

Any update made to an alert impacts the associated incident. An incident with all its associated alerts marked as resolved is automatically set to Auto-Resolved. Cortex XSIAM continues to group alerts to an Auto-Resolved Incident for up to six hours. In the case where an alert is triggered during this duration, Cortex XSIAM re-opens the incident.

RULE ID

ID that matches the rule that triggered the alert.

SEVERITY

Severity that was assigned to this alert when it was triggered (or modified).

STARRED

Whether the alert is starred by starring configuration.

SOURCE ZONE NAME

Source zone name of the connection for firewall alerts.