Alert exclusions in Cortex XDR are designed to reduce alert volume by filtering out events that are known to be benign or are expected within an environment. This practice, often called "tuning," helps security analysts focus on genuine threats. A trusted internal process, such as a custom in-house application or an administrative script, may exhibit behaviors that trigger security analytics. Similarly, legitimate vulnerability scanners intentionally probe systems in ways that can mimic malicious activity. Since these are authorized and expected activities, creating exclusions for the alerts they generate is a standard and justified practice to reduce false positives and analyst fatigue.
