topic Re: Analytic Bioc Rules in Cortex XDR Discussions

Analytic Bioc Rules

NathanBradley — Mon, 08 Feb 2021 20:38:14 GMT

Is there a way to see the actual detection of the analytic bioc rules

Normal bioc rules i can open in investigator but these i cannot

jcandelaria — Mon, 08 Feb 2021 20:57:46 GMT

Hi Nathan,

If you are looking for the actual xdr reference, below is the link where you can see the training period, learning period and description.

Thanks

Jomar Candelaria

NathanBradley — Tue, 09 Feb 2021 14:22:54 GMT

That is a good resource but not exactly what im looking for

When clicking rules>bioc. When right clicking a rule, for example "Powershell reverse shell", and open in query builder.

In query builder I can see its looking for remote port 4444 and cmd=*web*downloadstring*.ps1*|*web*downloadstring*.exe*

However when rules>bioc>analytic bioc rules. right clicking any rule and there is not an option to open in query builder

jcandelaria — Tue, 09 Feb 2021 17:58:36 GMT

Hi Nathan,

No that is possible to open in query builder as this is analytics rules, the reference that I posted is what explains that analytics rules.

Thanks

Jomar Candelaria