Palo_Alto_Networks
XDR-ANALYST · Question #74
In Cortex XDR, what action is taken once an incident is confirmed as benign?
The correct answer is C. Marked as a false positive or closed. Benign incidents are closed or marked as false positives to prevent unnecessary follow-up and to improve detection accuracy over time.
Incident Management and Triage
Question
In Cortex XDR, what action is taken once an incident is confirmed as benign?
Options
- AEscalated to playbook
- BDeleted from the timeline
- CMarked as a false positive or closed
- DAutomatically sent to Palo Alto TAC
How the community answered
(27 responses)- A11% (3)
- B4% (1)
- C78% (21)
- D7% (2)
Explanation
Benign incidents are closed or marked as false positives to prevent unnecessary follow-up and to improve detection accuracy over time.
Topics
#incident resolution#false positive#incident status#case management
Community Discussion
No community discussion yet for this question.