topic Re: Correlation rules and BIOCs in Cortex XDR Discussions

Correlation rules and BIOCs

FabioFerreira — Wed, 24 May 2023 14:43:42 GMT

Hi,

What correlation rules and BIOCs created manually do you suggest?

Regards,

Fábio Ferreira

Re: Correlation rules and BIOCs

anlynch — Wed, 24 May 2023 15:08:10 GMT

Hi @FabioFerreira,

For BIOC and correlation rules first I would recommend to start looking at threats you've seen in the past that weren't properly blocked or reported according to your organization's SOPs. Once that job has been handled sufficiently and your SOC team has matured I recommend looking outside of your organization and looking and new TTPs and threats that are being seen in the wild and build IOCs and correlations rules to match that activity.

I understand this may not be the information you're looking for, but no one outside of your organization is going to be able to tell you exactly what you need to be looking for. Different threats are more prevalent in certain industries/verticals than others. Also, everyone's team is at a different level of maturity.'

I hope this information helps.

Re: Correlation rules and BIOCs

FabioFerreira — Thu, 25 May 2023 12:40:18 GMT

Hi @anlynch

Thank you for your reply.

Sorry if I was not clear.

We are already doing that and that information we don't need.

I totally agree when you say, "no one outside of your organization is going to be able to tell you exactly what you need to be looking for"

I was looking for something more generic.

Let me know if you or someone could suggest some generic XQL or BIOC rules that could help us leverage our defenses.

Sharing that kind of information will for sure help all community, I believe 🙂

Regards,

Fábio Ferreira

Re: Correlation rules and BIOCs

AshokBabu — Mon, 28 Aug 2023 10:37:33 GMT

You can look into OSINT data bases like Sigma and analyze if it make sense to your organisation and the telemetry you are collecting and can work from there. Rules may be a bit noisy so obviously need to tune out things based on your org. Hope it helps