Test Custom BIOC Rules

Muhammad-Rusli — Mon, 29 Nov 2021 05:40:22 GMT

Hi Expert,

Please help me to create custom BIOC rules for the testing.

My company want to create rules bioc informational if We create/delete spesific file in spesific folder, and the information will appears in incidents.

Is it possible?

If is it possible, please inform to me How to create that?

Thanks Expert, please give me advice

Re: Test Custom BIOC Rules

bbarmanroy — Mon, 29 Nov 2021 09:37:28 GMT

Hi @Muhammad-Rusli , you need to use event_sub_type (in your case, these should be FILE_CREATE and FILE_REMOVE). Please see a basic BIOC to get you started. You can tune it to your needs.

dataset = xdr_data 
| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_REMOVE) and action_file_path contains "D:\"

Link: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html

topic Test Custom BIOC Rules in Cortex XDR Discussions

Test Custom BIOC Rules

Re: Test Custom BIOC Rules