Notifications
Clear all
Palo Alto Cortex XDR Reviews
1
Posts
1
Users
0
Reactions
4
Views
Topic starter
14/07/2026 5:46 pm
Just migrated our Linux servers to Cortex XDR. The 'suspicious script' rule is a nightmare. Alert volume went up 300%. It's flagging our own Ansible playbooks and standard cron jobs.
Example from an alert. It's just a bash script deploying a config via Ansible.
```bash
#!/bin/bash
# Deploy new httpd config
ansible-playbook -i inventory webserver.yml --tags "config"
```
The rule logic seems to be: if it's a script and it calls another process, it's suspicious. That's every orchestration tool we use.
Anyone else burning cycles tuning this out? What's your whitelist pattern look like?
Don't panic, have a rollback plan.