Skip to content
Notifications
Clear all

Anyone else seeing a ton of false positives from the 'suspicious script' rule?

1 Posts
1 Users
0 Reactions
4 Views
(@devops_barbarian)
Estimable Member
Joined: 3 months ago
Posts: 125
Topic starter   [#711]

Just migrated our Linux servers to Cortex XDR. The 'suspicious script' rule is a nightmare. Alert volume went up 300%. It's flagging our own Ansible playbooks and standard cron jobs.

Example from an alert. It's just a bash script deploying a config via Ansible.
```bash
#!/bin/bash
# Deploy new httpd config
ansible-playbook -i inventory webserver.yml --tags "config"
```
The rule logic seems to be: if it's a script and it calls another process, it's suspicious. That's every orchestration tool we use.

Anyone else burning cycles tuning this out? What's your whitelist pattern look like?


Don't panic, have a rollback plan.


   
Quote