topic Re: Hunting for Keywords - How to do that in Cortex xdr Pro? in Cortex XDR Discussions

Hunting for Keywords - How to do that in Cortex xdr Pro?

RFeyertag — Wed, 21 Jun 2023 21:40:33 GMT

Hello dear community,

how could this keywords be integrated into cortex xdr pro?

https://mthcht.github.io/ThreatHunting-Keywords/

happy hunting!

Rob

Re: Hunting for Keywords - How to do that in Cortex xdr Pro?

anlynch — Thu, 22 Jun 2023 19:51:42 GMT

Hi @RFeyertag,

If you're wanting to set up detection rules these keywords there are a few ways you could do it.

You could use a custom script and interface with the API. Although a simpler method might just be to add these as appropriate BIOCs.

Let me know if you like either of these ideas.

Re: Hunting for Keywords - How to do that in Cortex xdr Pro?

RFeyertag — Thu, 22 Jun 2023 21:34:24 GMT

Do you think this BIOC creation could be done by the experts from PA/Cortex XDR team?

Rob

Re: Hunting for Keywords - How to do that in Cortex xdr Pro?

anlynch — Fri, 23 Jun 2023 12:19:40 GMT

I believe some of these are currently protected out of the box with Cortex XDR and it's always possible more will be added in future content updates. Unless you've tested and confirmed I'd suggest adding them as BIOC's as each organization has different needs.