topic Re: Feature Request: Ability to add a 'Comment' when Bulk Uploading IOC Rules in XDR in Cortex XDR Discussions

Feature Request: Ability to add a 'Comment' when Bulk Uploading IOC Rules in XDR

AlCurran — Tue, 29 Dec 2020 22:05:48 GMT

When adding IOC's to XDR, adding a comment is a useful way to keep track of where the IOC originated from. When an alert is triggered from that IOC, the analyst can review the IOC rule and read the comment for context.

When 'bulk' uploading, using a file for example, there is no comment field. Is it possible to add the ability to make a comment for all entries made during a bulk upload?

Thanks.

Re: Feature Request: Ability to add a 'Comment' when Bulk Uploading IOC Rules in XDR

gjenkins — Tue, 29 Dec 2020 22:24:05 GMT

Hi @AlCurran,

That is a great suggestion, indeed.

For an immediate solution, you can add a comment after performing the bulk upload by selecting the checkbox next to the target IOCs, right-clicking, and then selecting "edit selected." The comment field will be editable from there.

To make the selection easier, you can filter by modification date to find the IOCs created only when uploaded.

As for submitting a feature request to submit a comment at upload, I recommend submitting that to your Account team directly as I do not believe that they monitor this discussion board.

Re: Feature Request: Ability to add a 'Comment' when Bulk Uploading IOC Rules in XDR

AlCurran — Tue, 29 Dec 2020 23:48:18 GMT

Great work around, thanks!

Yeah I’ve suggested it via our account team but haven’t heard back. Just wanted to know if this was something others would be interested in. It’s a small addition but would really help our manual IOC process.

Thanks for your reply!