What is the cause when alerts generated by a correlation rule are not creating an incident?

The correct answer is B. The rule is configured with alert severity below Medium. For Correlation rules a case is automatically opened only if the generated issue/alert has a severity of Medium or higher. Issues generated with Low or Information severity are not grouped into cases automatically.

Alert Management and Correlation

Question

Options

AThe rule does not have a drill-down query configured.
BThe rule is configured with alert severity below Medium.
CThe rule has alert suppression enabled.
DThe rule is using the preconfigured Cortex XSIAM alert field mapping.

How the community answered

(31 responses)

A
6% (2)
B
77% (24)
C
13% (4)
D
3% (1)

Explanation

For Correlation rules a case is automatically opened only if the generated issue/alert has a severity of Medium or higher. Issues generated with Low or Information severity are not grouped into cases automatically.

Topics

#correlation rules#incident creation#alert severity#alert suppression

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice