topic Re: Check IP reputation through IOC in Cortex XDR Discussions

Check IP reputation through IOC

FabioFerreira — Fri, 28 Apr 2023 19:09:29 GMT

Hi,

I need to create a XQL or something in Cortex XDR, where I get IP address from O365 logs and check if match with IOCs I have in Cortex XDR.

Could you help

Regards,

Fábio Ferreira

timurphy — Wed, 03 May 2023 14:20:26 GMT

There aren't any built-in datasets that list all IOCs that have been entered into XDR at this time.

An option to consider is uploading a custom dataset (lookup) containing your IOCs, and then using the join stage to accomplish this.

Regards,

Tim

FabioFerreira — Mon, 08 May 2023 17:39:13 GMT

Thank you for your answer.

I have more than 10k IOCs in XDR, I need to find a way to query this inside XDR if possible.

Can I create a custom dataset based on the IOCs that exists in Cortex XDR?

Or maybe export them and them import them through a script inside XDR and then get them into a new dataset ?