topic Re: Authentication BIOC rule in Cortex XDR Discussions

Authentication BIOC rule

BenHooper — Tue, 22 Sep 2020 14:32:01 GMT

Currently, I can create one-off or scheduled queries for authentication data / events but not BIOC rules which isn't ideal because scheduled queries don't create incidents.

Is it on the roadmap to add this ability?

Thanks.

Re: Authentication BIOC rule

dfalcon — Sun, 06 Dec 2020 18:38:36 GMT

Hi @BenHooper -

I will look into thee authentication option, although I won't be able to post roadmap information in the forums. In the interim, have you tried leveraging an XQL with a BIOC based on those results?