Is it normal to see your tools lie?

Maybe it's me and/or my org, but lately, it seems like every incident/ ticket/ alert we get, is false positive. I expect that in this line of work, but as I start to dig into the new and unfamiliar ones, I've been seeing a new and more worrisome trend: A complete absence of data, or bad data.

We use Cortex XDR, and generally when it alerts on malware, you can find it and take action. This week though, it's been …

alert cybersecurity dig expect false positive incident line normal org start ticket tools trend work