The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options would prevent Cortex XD

The correct answer is D. Create a global exception.. When a known-benign application is incorrectly blocked by Cortex XDR and you want to prevent that block across the entire organization (all endpoints), you must create a Global Exception. A global exception applies the exclusion universally to every endpoint managed by the Cortex

Submitted by certguy· Apr 18, 2026Detection and Alert Management

Question

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?

Options

ACreate an endpoint-specific exception.
BCreate a global inclusion.
CCreate an individual alert exclusion.
DCreate a global exception.

How the community answered

(28 responses)

A
4% (1)
B
7% (2)
C
11% (3)
D
79% (22)

Explanation

When a known-benign application is incorrectly blocked by Cortex XDR and you want to prevent that block across the entire organization (all endpoints), you must create a Global Exception. A global exception applies the exclusion universally to every endpoint managed by the Cortex XDR tenant. An endpoint-specific exception (A) would only fix the issue on one machine. A global inclusion (B) is not a standard Cortex XDR construct for this purpose. An individual alert exclusion (C) would suppress the alert but may not prevent the blocking action from occurring again in all cases or across all endpoints.

Topics

#False Positives#Global Exceptions#Policy Management#Prevention Tuning

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice