Which of the following represents the correct relation of alerts to incidents?

The correct answer is C. Alerts with same causality chains that occur within a given time frame are grouped together into an. Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator…

Submitted by paula_co· Apr 18, 2026Detection and Alert Management

Question

Options

AOnly alerts with the same host are grouped together into one Incident in a given time frame.
BAlerts that occur within a three hour time frame are grouped together into one Incident.
CAlerts with same causality chains that occur within a given time frame are grouped together into an
DEvery alert creates a new Incident.

How the community answered

(26 responses)

B
8% (2)
C
88% (23)
D
4% (1)

Explanation

Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator- Guide/Investigate-Incidents

Topics

#Alerts#Incidents#Causality Chains#Alert Grouping

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice