topic Re: XDR BIOC Rules in Cortex XDR Discussions

XDR BIOC Rules

Shahwaz_Md — Mon, 08 Jan 2024 13:23:28 GMT

Hi All,

We have a few Palo Alto BIOCs that are disabled in our console, does Palo alto disables those rules by themselves if yes where can we find more details about it like why it was disabled in the first place.

Regards,

Shahwaz

Re: XDR BIOC Rules

nsinghvirk — Wed, 10 Jan 2024 13:00:04 GMT

Hello @Shahwaz_Md

Thanks for reaching out on LiveCommunity!

Yes, BIOC rules can get auto disable if they generate too many alerts. XDR's anti flooding mechanism disables the BIOC rule and also provide you reason under the "Disable Reason" field in the BIOC rule table. You can even hover your mouse on the status and a pop up will appear with details like who disabled the rule, when and why it was disabled.

More details-> https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-with-BIOCs

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: XDR BIOC Rules

Shahwaz_Md — Tue, 16 Jan 2024 07:36:24 GMT

Hi ,

I can't see anything when i hover over the disabled rule, i suspect this was disabled as a part of content update. Can you pls help me where i can check the content release notes.

Regards,

Shahwaz

Re: XDR BIOC Rules

nsinghvirk — Tue, 16 Jan 2024 14:32:05 GMT

Hello @Shahwaz_Md

This feature has not been disabled. You need to move your mouse on the "Disabled" keyword. Are you able to see the "Disabled Reason" column?

To check the latest release notes, please click on the Username at the bottom left side and then click on "What's new in this Release". Here you can see the latest features and link to release notes.