topic Re: Cortex XDR Identify Certain Execution in Cortex XDR Discussions

Cortex XDR Identify Certain Execution

Tharaka-Wijesinghe — Wed, 04 Oct 2023 10:34:10 GMT

I want cortex to generate an incident if a specific file(mp4, jpg) is executed. Is there any possibility to do this? How is that?

Re: Cortex XDR Identify Certain Execution

jmazzeo — Wed, 04 Oct 2023 13:34:37 GMT

Hi @Tharaka-Wijesinghe , thanks for reaching the Live Community.

Yes, you can create a custom BIOC rule in Detection Rules -> BIOC -> + Add BIOC

In this example I'm monitoring zip files, but you can create the file extensios you need with the "*" wildcard.

Please let me know if this works for you.

Re: Cortex XDR Identify Certain Execution

Tharaka-Wijesinghe — Thu, 05 Oct 2023 04:18:12 GMT

Hi Jmazzeo

I created the rule and when I tested it, it showed me some incidents. Now I can't find the rule which I created. Can you just tell me from where I can see that Rule which I created and the incidents triggered against it??

Re: Cortex XDR Identify Certain Execution

jmazzeo — Thu, 05 Oct 2023 12:05:08 GMT

Hi @Tharaka-Wijesinghe

You can see and edit the created rule in the BIOC section, under Detection Rules -> BIOC.

The rule will have the name that you configured in the creation step., anyway you can use any filter to help you find it.