Hi,
I’m encountering a scalability issue with our malware playbook after the recent Cortex XDR integration update.
The problem is the following:
-
Cortex XDR now generates a separate Issue for each file detected as malicious during periodic scans.
-
All malicious files are also stored under Key Assets & Artifacts in Cortex.
-
In Google SecOps, each XDR Issue becomes one Alert associated with the same Case.
-
However, each Alert contains all existing Artifacts, not only the ones related to that specific Issue
When the malware playbook runs on each alert, it sends one VirusTotal request per hash.
Since the Case contains 27 alerts, and each alert includes the same 48 artifacts, the playbook ends up sending:
27 alerts × 48 artifacts = 1,296 VirusTotal API requests
Most of these requests are redundant, because the artifacts are identical across alerts.
We only need to submit 48 VirusTotal lookups, not 1,296.
This behavior causes unnecessary API consumption and may lead to quota exhaustion or delays.
Is there a way to avoid duplicate VT lookups across alerts within the same Case?
Thanks a lot!
