topic Cortex XDR Pro - Uploading IOCs - also working retrospectively? in Cortex XDR Discussions

Cortex XDR Pro - Uploading IOCs - also working retrospectively?

RFeyertag — Wed, 01 Mar 2023 23:03:29 GMT

Hello dear community,

I've read something about uploading IOCs and I would like to know, if they also work retrospectively?

How else?

Do I create/upload an IOC and these will only be triggerd, when this IOC is seen in the future?

Here are some information from the documentation? But like you can see:

Rob

etugriceri — Thu, 02 Mar 2023 09:49:31 GMT

its working retrospectively and if its detect something, You'll have an alert like below.

RFeyertag — Fri, 03 Mar 2023 19:39:36 GMT

Thank you so much for this clarification!

Then I will start my little project, to download some TI and upload it to Cortex XDR Pro.

If there are any ressources for uploading IOCs directly from other sources to Cortex, I'd would be appreaciate.

Rob