topic Palo Alto BIOC rule content error [specific rule] in Cortex XDR Discussions

Palo Alto BIOC rule content error [specific rule]

ithermos — Fri, 24 Feb 2023 11:02:30 GMT

Hello,

There is an issue with one of the BIOC rules provided by Palo Alto. Specifically in the rule with Global ID "94fed992-c1da-4b69-9caa-292221b8c070".

The wildcards for the command line arguments that this rule intents to detect, are off. To be precise all leading wildcards in this detection have a space afterwards, thus rendering the rule unable to detect the actual activity taking place.
E.g. (not real argument): * test*, while the correct would be *test*.

I have tested this and indeed it does not work as intended right now.

Could you please review it from your side and make the necessary changes or guide me in order to open a ticket/email elsewhere if needed ? But from what I understand, this is not a tenant specific issue, so I thought opening a thread here was more appropriate.

Thanks in advance,
Ilias

Re: Palo Alto BIOC rule content error [specific rule]

timurphy — Fri, 24 Feb 2023 18:08:15 GMT

Hi @ithermos.

I would recommend opening a TAC case with these findings so that it is properly documented and can be investigated internally by Palo Alto teams.

Re: Palo Alto BIOC rule content error [specific rule]

ithermos — Wed, 15 Mar 2023 08:22:23 GMT

Hi all,

Just a heads up, via TAC case indeed, the resolution is on the way. IMO though, there should be another path for these kinds of issues (rule/content based, global etc).

Thanks,
Ilias