Skip to main content

Cortex XDR - False Positive Incident Handling

This Playbook is part of the Cortex XDR by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to This playbook handles false-positive incident closures for Cortex XDR - Malware investigation.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • Cortex XDR - Unisolate Endpoint


  • CortexXDRIR


This playbook does not use any scripts.


  • closeInvestigation
  • setIndicators
  • xdr-allowlist-files

Playbook Inputs#

NameDescriptionDefault ValueRequired
CommentAdd comment to close this incident.XSOAR Incident #${}Optional
ReasonChoose From - "Unknown" / "TruePositive" / "FalsePositive"FalsePositiveOptional
AllowTagThe approving tag name for found indicators.AllowTagOptional
AutoUnisolationWhether automatic unisolation is allowed.FalseOptional
HostIDThe ID of the host for running an un-isolation process.${incident.deviceid}Optional
FileSha256The File SHA256 you want to block.${incident.filesha256}Optional

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Cortex XDR - False Positive Incident Handling