topic Analytic BIOC Rules, right click open in query builder, informational severity not available in Cortex XDR Discussions

Analytic BIOC Rules, right click open in query builder, informational severity not available

NathanBradley — Tue, 10 May 2022 14:04:57 GMT

We have a support ticket open for "informational" analytic BIOC rules that are not alerting.

These do not show up in the incidents or alert table, but the number of alerts in that column has more than 0

Support has indicated there is not a way to view the hits of the rule

Does anyone know a way to view these analytic bioc rule alerts

When viewing normal bioc rules, you can right click and open in query builder.

This option isn't available when looking at analytic bioc rules.

Is there a place or way to view how the rule is structured...what the xql query is?

Re: Analytic BIOC Rules, right click open in query builder, informational severity not available

KanwarSingh01 — Thu, 12 May 2022 04:46:59 GMT

@NathanBradley

The below article can best explain you the logic behind all the ABIOC rules setup in Cortex.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference

In general, informational alerts will only show up when an incident is triggered and get stitched with other alerts as part of insights in an incident to help better understand the incident.

Speaking for myself, if we start investigating into informational alerts then we will end up chasing false positives but there might be cases where your investigation might lead to a possible suspicious activity.

In order to find the suspicious activity you will first need to know some start point. For example:

In this cases we are looking for a command called "net user" (we created a BIOC rule to detect this command as informational). So lets say the query returned a result from there on we dig into the causality chain and then click on the process itself and then see the activity for alert as informational. (Not the best way to look for informational alert but does the trick.) You can use a similar logic to find ABIOC informational alerts.

Thank You.

Re: Analytic BIOC Rules, right click open in query builder, informational severity not available

NathanBradley — Thu, 12 May 2022 14:05:45 GMT

Im looking for a way to either see the events that caused the analytic bioc to fire

or a way to view the query behind the rule

For example the rule below has 7 alerts

Re: Analytic BIOC Rules, right click open in query builder, informational severity not available

SamuelSt — Mon, 16 Jan 2023 22:05:26 GMT

Wondering how I can hunt for BIOC "elevation of privilege" events, for example pertinent to "CVE-2023-21674 "