topic Analytics BIOC Rule, Identity analytics in Cortex XDR Discussions

Analytics BIOC Rule, Identity analytics

Pieter.Rubens — Mon, 30 May 2022 10:05:08 GMT

Hi all

I have a question regarding a certain alert: Multiple user accounts deleted

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/multiple-user-accounts-were-deleted

1) Is it normal I can't find it in the Analytics BIOC list?

2) Is it possible to view the query behind these rules? because currently this is informational-low and we want to change the severity to a higher status.
3) if this is not possible, I'm guessing we have to write a custom rule for this?

thank you

Re: Analytics BIOC Rule, Identity analytics

bbarmanroy — Tue, 31 May 2022 02:03:04 GMT

Hi @Pieter.Rubens

1. I am looking into this why this rule does not appear.

2. These queries are managed by Cortex XDR Detections team and are constantly being added/updated to the existing list on the server side. As such, the queries are not viewable.

3. You can of course create a custom BIOC rule where you ingest AD logs and look for entries that log these behavior and go off it. That being said, a Correlation rule might be a better fit for the same as you need to look at historical data to formulate your logic.