topic Re: Detection of various open source apps in Cortex XDR Discussions

Detection of various open source apps

Shahwaz_Md — Thu, 25 May 2023 12:51:59 GMT

Hi All,

We want alerts to be triggered for various open-source applications like NodeJS, Nginx, Python, etc.

Kindly let me know how we can achieve this.

Thanks

aleksandar.astardzhiev — Thu, 25 May 2023 13:36:25 GMT

Can you give a bit more information what you want to achieve?

What do you mean by detect open-source app? When process is started/executed? When installed? When generating traffic?

Shahwaz_Md — Thu, 25 May 2023 13:48:36 GMT

We want an alert/incident to be triggered when the process is started/executed.

Shahwaz_Md — Fri, 26 May 2023 14:29:34 GMT

Hi Aleksandar,

Kindly share any suggestions for this.

bbarmanroy — Mon, 29 May 2023 07:53:14 GMT

Hi @Shahwaz_Md you'll need to look at creating custom BIOC's to trigger alerts when the process is spawned.
There's an excellent LiveCommunity threat that has been around for a while to detect such behavior (including blocking such executions) - you can read it here (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/blocking-file-execution-based-on-nameand-or-bioc-ioc/td-p/441563).

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule