Cortex XDR automatically disables BIOC rules that reach how many hits over what period of time?

Cortex XDR implements an automatic disabling mechanism for BIOC rules that trigger excessively, specifically when they generate 5,000 or more hits over a 24-hour period. This measure prevents alert fatigue and ensures that only relevant, high-fidelity alerts are prioritized, indicating a rule that may be too broad or misconfigured.

1,000 or more hits over a 24-hour period is below the threshold for automatic disabling of BIOC rules in Cortex XDR.

While 5,000 hits is the correct quantity, the period for automatic disabling is 24 hours, not 12 hours.

Both the hit count (1,000) and the time period (12 hours) are incorrect for the automatic disabling threshold.