BIOC Analytics Specific Exceptions and Vendor Exceptions

michaelsysec242 — Wed, 24 Aug 2022 06:41:46 GMT

Hello all,

I have encountered multiple occurrences in which a specific process raise many of the same BIOC Analytics Alert. I understand that engine is based on server side and as a customer we are not privy to see what calculations are done on our behalf. In regards to Exclusion, exclusion can only be carried out for the entire alert.

1) Is there a way to individually exclude certain processes that are causing many of the same BIOC Analytics alerts ?

2) Is it possible to define on the XDR Tenant that you use an additional security product by a different vendor and that no alerts should be raised by their behaviour including BIOC Analytics?

In my experience the BIOC Analytics Mechanism is very powerful yet lacks this fundamental flexibility.

Re: BIOC Analytics Specific Exceptions and Vendor Exceptions

bbucao — Wed, 24 Aug 2022 14:50:05 GMT

Hi Michaelsysec242,

1. If you are wanting to exclude Analytic BIOC alerts based on process, you can do this through an Exclusion Policy. Navigate to Incident Response > Incident Configuration > Alert Exclusions > +Add Alert Exclusions. Here you can define a policy to exclude alerts based on any combination of criteria using the table filters. For example I could filter on Alert Source = XDR Analytics BIOC and Initiated By = someGoodProcess.exe. This would Exclude any Analytic BIOC alert that is initiated by the defined process. Keep in mind, Exclusion policies do not change XDR behavior, they only exclude these alerts from being viewable or generating Incidents, So if you create Exclusion policies for alerts generated from the XDR agent, there is the risk of excluding traffic that could still be blocked.

2. There is no capability to universally allow specific software in the platform. For any agent side detections such as the Malware and Exploit protection modules, you would need to ensure each module is set to allow the specific processes, then for all other alert types such as Analytics, BIOC, IOC etc. you can create Exclusion policies as mentioned above.

Regards,
Ben

topic BIOC Analytics Specific Exceptions and Vendor Exceptions in Cortex XDR Discussions

BIOC Analytics Specific Exceptions and Vendor Exceptions

Re: BIOC Analytics Specific Exceptions and Vendor Exceptions