Handle False Positive Alerts

This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.

Common Playbooks · 20 tasks · 7 inputs · 0 outputs

Inputs

  • ShouldCloseAutomatically — Whether to automatically close false positive alerts? Specify true/false.
  • sourceIP — The host IP address from the alert.
  • username — The username from the alert.
  • alertName — The alert name.
  • FileSHA256 — The file SHA256 from the alert.
  • IOC — The IOC to disable from IOC alerts.
  • ShouldHandleFPautomatically — Whether to automatically handle false positive alerts? Specify true/false.

Commands used

closeInvestigation core-add-exclusion core-allowlist-files core-iocs-disable

Flowchart

Yes Analytics XDR Agent IOC Alert yes AWS IAM FW Yes Start Start Add the source IP to Alert Exclusion list - core-add-exclusion Add the source IP to Aler... core-add-exclusion Add the file to the allowed list automatically? Add the file to the allow... Manual - Create alert exception Manual - Create alert exc... Check the alert source Check the alert source Alert Closing Alert Closing Add Exception or Exclusion Add Exception or Exclusion Should close alert automatically? Should close alert automa... Close alert as FP - closeInvestigation Close alert as FP closeInvestigation Done Done Check alert origin Check alert origin NGFW Alerts NGFW Alerts Add file hash to allowed list - core-allowlist-files Add file hash to allowed ... core-allowlist-files AWS IAM Alerts AWS IAM Alerts Add the host IP and username to Alert Exclusion list - core-add-exclusion Add the host IP and usern... core-add-exclusion SHA256 SHA256 Add the file SHA256 to Alert Exclusion list - core-add-exclusion Add the file SHA256 to Al... core-add-exclusion Disable IOC rule automatically - core-iocs-disable Disable IOC rule automati... core-iocs-disable Whether to disable indicator IOC rule automatically? Whether to disable indica... Disable IOC rules Disable IOC rules