topic Respository - Sharing BIOC Rules for Import in Cortex XDR Discussions

Respository - Sharing BIOC Rules for Import

RFeyertag — Sun, 25 Sep 2022 19:46:32 GMT

Hello dear community,

does someone of you know, where we can find a respository for extended bioc rules to import them?

One was mentioned here:

https://github.com/Data-Equipment-AS/CortexXDR-BIOC

Maybe some of you want to share their bioc rules? Me personally would be interested in event_id, like create a new account etc.

Rob

Re: Respository - Sharing BIOC Rules for Import

bbarmanroy — Mon, 26 Sep 2022 07:11:01 GMT

Great idea @RFeyertag !
How about you create a few PR's for the repo you mentioned with a few use cases? I am sure the community can come up with use cases!

*Note* : Do remember not to include any sensitive info like hashes, paths that provide more information about your environment.

E.g. replace a path "C:\ProgramFiles\MajorBank\abc.exe" with "C:\ProgramFiles\<insertPathHere>\abc.exe".