topic System Threshold exception BIOC rules in Cortex XDR Discussions

System Threshold exception BIOC rules

DavidStevens — Mon, 22 May 2023 09:35:53 GMT

I have once upon a time set the system threshold exception to 100 hosts. So when the same BIOC is triggered on 100 hosts at the same time, it automatically creates an exception. I would like to raise the number of hosts, but I cannot find the place to change this setting. It is nowhere to be found. I seem to recall it being a setting in a menu once upon a time, but it is lost to me.

Does anyone know where i can find it?

sorry about the small picture. It says Same process triggered Bioc 46 on 100 different hosts.

Re: System Threshold exception BIOC rules

PiyushKohli — Mon, 22 May 2023 10:28:20 GMT

Hi @DavidStevens

Thank you for writing to live community!

If I understand correctly you may have configured this BIOC as a Custom Prevention Rule. If yes, then you may change the threshold in the Restriction Profile of your Assigned Prevention Policy on those endpoints for which BIOC alerts/incidents triggered.

Screenshot for reference:

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: System Threshold exception BIOC rules

DavidStevens — Mon, 22 May 2023 13:31:56 GMT

Hi,

Thank you so much for that! That was exactly what i was looking for. Couldn't find the answer with all the keywords i used.