An analyst identifies that a custom internal application is being incorrectly flagged as malicious by...

In Cortex XDR, Exceptions are the preferred method for tuning the platform to reduce false positives without creating broad security gaps.

Granular Control: When you create an exception from a specific alert, Cortex XDR allows you to define the scope based on specific attributes like the process name, command line, or file path.

Targeted Tuning: Unlike disabling an entire module (Option A), an exception only ignores the specific behavior for that specific application.

Ease of Use: This can be done directly from the "Check Action" or "Alerts" tab within an incident, allowing the analyst to quickly suppress future occurrences of that specific false positive.