Palo Alto Cortex XDR: New incident detected

This rule is part of a beta feature. To learn more, contact Support.
palo-alto-cortex-xdr

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1059-command-and-scripting-interpreter

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Monitor and respond to new incidents generated by Palo Alto Cortex XDR.

Strategy

Trigger notifications for any new incident generated by Palo Alto Cortex XDR. See [Triage Incidents][1] in the Cortex Help Center for more information.

Triage and response

  1. Investigate the new incident details from here {{@xdr_url}}, focusing on the severity level {{@severity}}.
  2. Notify the appropriate team for further analysis.
  3. Adhere to organizational protocols to effectively address and mitigate the incident impact.

[1] https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Triage-Incidents