Which action helps reduce alert fatigue in Cortex XDR dashboards?

Alert fatigue is a significant challenge for security operations teams, caused by an overwhelming volume of security alerts. Cortex XDR helps mitigate this by assigning a severity level (Low, Medium, High, Critical) to alerts and incidents. This allows analysts to prioritize their efforts, focusing on the most critical threats first. By systematically addressing high-severity alerts, teams can manage their workload more effectively and reduce the noise from less urgent notifications, directly combating alert fatigue.

B. Enabling auto-deletion of low-severity logs: Deleting logs, regardless of severity, is detrimental to forensic investigations and compliance, and is not a recommended practice or a feature for managing alert volume.

C. Blocking alerts from external sources: This is an impractical and dangerous action, as it would blind the security team to a vast majority of potential threats originating from outside the network.

D. Disabling alert correlation: Alert correlation is a key Cortex XDR feature that reduces alert fatigue by grouping thousands of low-confidence alerts into a single, high-confidence incident. Disabling it would have the opposite effect.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Incidents". This section details how Cortex XDR groups related alerts into incidents and assigns severity, which is the basis for prioritization.

2. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Triage Incidents". This section explicitly describes the workflow for investigating incidents, starting with prioritization based on severity to manage the workload.