topic Re: Multiple Queries regarding cortex XDR in Cortex XDR Discussions

Multiple Queries regarding cortex XDR

Shashanksinha — Thu, 24 Nov 2022 07:30:47 GMT

Hello,

Is it possible to know the following :

1. Whether BIOC rules generate alerts/incidents in case there is a match for Custom prevention rules.

2. Any method to bulk hash blocking using Action center.

3. If we are hosting XDR firewall simultaneously, can we host another firewall from other tools .

Re: Multiple Queries regarding cortex XDR

bbarmanroy — Thu, 24 Nov 2022 07:53:17 GMT

Hi @Shashanksinha the answers are

1. Yes

2. Yes you can enter multiple entries in one go using Action Center

Alternately, you can also use API's as that eliminates the need to copy-paste one at a time. You can then leverage the ability to ingest multiple entries, one at a time, each with their own comments.

3. You can take a look at the list here and see if this meets your requirements (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/external-data-ingestion/about-external-data-ingestion).

Re: Multiple Queries regarding cortex XDR

Shashanksinha — Thu, 24 Nov 2022 07:57:11 GMT

Hello,

Thanks for the response .

I wanted to ask instead of adding one-by one .Is there any method to upload it through some sheet without copy-pasting one by one

Like we can add IOC in the XDR console in bulk uploading notepad file or csv file .

Re: Multiple Queries regarding cortex XDR

bbarmanroy — Thu, 24 Nov 2022 10:04:11 GMT

Hi @Shashanksinha that's not possible now. The workaround is to use the API via a programming language or scripting language of your choice or use the Cortex XDR Postman API collection to perform the same.

Take a look at the detailed walkthrough of how to configure Postman to do the action you're asking for.

Ref: https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-postman-api-collection/ba-p/443845