topic Re: XDR Usecase Creation | XDR Rule in Cortex XDR Discussions

XDR Usecase Creation | XDR Rule

Mohitparashar — Fri, 01 Dec 2023 13:15:58 GMT

We have 3 use cases for which we want to set up 3 rules in XDR, we would like to get your help to identify the best avenue to address them :

UC 1 : deploy a rule that DETECT a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
UC 2 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
UC 3 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), WITHOUT generating an incident.

For each use case, please advise what feature to use (e.g.: BIOC, blocklist, correlation rule) and if a change in the profiles is required, as per your guides and best practices.

@LiveCommunityMemberOD @JayGolf

Re: XDR Usecase Creation | XDR Rule

jtalton — Tue, 05 Dec 2023 17:02:56 GMT

Hi Mohitparashar,

Adding an IOC is a Detect Only indicator. We recommend that IOCs be added to the firewall policy to block as URL filtering is a Layer 7 mechanism and Cortex operates on Layer 3. If you are using a Palo Alto firewall you may leverage the EDL (Manage External Dynamic Lists ) to block the domain and IP.

For non-network events, you may create a custom BIOC using an XQL query to enable a custom prevention rule then add it to the Restrictions Profile applied to the endpoints as outlined in this video Custom Prevention Rules| Palo Alto Networks

The following describes the event_type values for which you can create a BIOC rule.

FILE—Events relating to file create, write, read, and rename according to the file name and path.
INJECTION—Events related to process injections.
LOAD_IMAGE—Events relating to module IDs of processes.
NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.
PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.
REGISTRY—Events relating to registry write, rename and delete according to registry path.
STORY—Events relating to a combination of firewall and endpoint logs over the network.
EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.

Once created, you can add the BIOC to restrictions profiles.

A few caveats...

Please note, XDR works on process instances termination and not network termination. For example, any network connection made using browsers for the URL (using a BIOC) will kill the browser itself and not just the network connection. As a result, all other browser tabs will also shut down. Therefore, adding a BIOC for domains/IPs is not a recommended action. It is recommended to set up a firewall configuration for URL filtering.

Reference

Create a BIOC Rule • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

Threat Hunting with XDR | Palo Alto Networks

If you found this answer helpful, please select Accept as Solution.

Thank you

Re: XDR Usecase Creation | XDR Rule

Mohitparashar — Tue, 05 Dec 2023 16:58:53 GMT

Hello @jtalton

My access to the video resource is denied.
https://live.paloaltonetworks.com/t5/shaolin-beta-articles/video-tutorial-custom-prevention-rules/ta-p/341971

Could you please help me with how to access and why it is getting denied?

Regards,

Mohit

Re: XDR Usecase Creation | XDR Rule

jtalton — Tue, 05 Dec 2023 17:02:19 GMT

Sorry this is the correct link Custom Prevention Rules| Palo Alto Networks