Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

tejaspatil12 — Tue, 23 Jan 2024 09:34:00 GMT

Hello team,

Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block ? or how Cortex XDR decide to block/detect the behavioral threat alert?

Re: Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

nsinghvirk — Mon, 29 Jan 2024 12:43:51 GMT

Hello @tejaspatil12

Thanks for reaching out on LiveCommunity!

Analytics BIOC alerts are for detect/alert purpose they do not provide block functionality. Analytics BIOCs are not produced in real time and therefore cannot block. Please take a look at the Analytics Concepts. for a better understanding of how analytics work. Essentially it's looking at a lot of different factors after the event to determine the larger picture.

By looking into the activity that caused the alert you may be able to find similarities you can use to create a high fidelity BIOC and then you can configure BIOC rules as custom prevention rules and incorporate them with your Restrictions profiles.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-with-BIOCs

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block in Cortex XDR Discussions

Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

Re: Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block