topic Re: timestamps for suppression rule (BIOC) in Cortex XDR Discussions

timestamps for suppression rule (BIOC)

S-LEGOUGE — Thu, 05 Jan 2023 10:02:14 GMT

Hello everyone,

I need your help because I want to create a BIOC deletion rule, I have the hash, the username and the path but I would like this deletion to be effective during a specific time slot, can it be configured?

Re: timestamps for suppression rule (BIOC)

neelrohit — Thu, 05 Jan 2023 15:07:03 GMT

Hi @S-LEGOUGE ,

Thank you for writing to live community!

IOC/BIOC suppression rule cannot be schduled as they are global by nature and real time.

Re: timestamps for suppression rule (BIOC)

S-LEGOUGE — Thu, 05 Jan 2023 16:29:33 GMT

Hi @neelrohit

Thank you very much for this precision, do you think it would be possible to avoid any alert resulting from a BIOC rule by using a correlation rule because I see that we can define a calendar?

Thanks in advance

Re: timestamps for suppression rule (BIOC)

neelrohit — Fri, 06 Jan 2023 06:08:56 GMT

Hi @S-LEGOUGE ,

Avoiding a BIOC rule to get a hit and generate an alert can happen in 3 ways only:

You disable the BIOC rule
You create rule exceptions(now known as IOC/BIOC suppression rules)
Disable the original BIOC rule, create a copy of it and fine tune it as per your own requirements

Correlation rule is another mechanism of creating alerting rules as per your choice on the basis of XQL queries and scheduling the XQL to run for a time frame in a particular period.

Hope this helps!

Please mark the answer "Accepted as Solution" if it does

Regards

Re: timestamps for suppression rule (BIOC)

S-LEGOUGE — Fri, 06 Jan 2023 08:10:25 GMT

Hello @Neelrohit ,

Thank you very much for this explanation and that answers my question.

Thank you again and my best wishes for 2023 😉

Regards,

Sebastien