topic Re: Suspicious domain suffix with a rare user agent - Explanation in Cortex XDR Discussions

Suspicious domain suffix with a rare user agent - Explanation

AvesterFahimipour — Tue, 30 Apr 2024 07:46:16 GMT

Hello Community,

The BIOC Analytics has recently added these alerts and I wanted to get some insight and I hope this thread can be used in the future by others as well.

While the same seems straightforward there are some issues. The name of the alert suggests that a suspicious domain suffix was seen WITH a rare user agent.

The issue is that in the datasets the user agent field is NULL. So unless the originating process (chrome for example) is compromised it should not have a rare user agent. But I see that the domains reached out to are generally considered as normal.

Re: Suspicious domain suffix with a rare user agent - Explanation

jmazzeo — Thu, 02 May 2024 15:53:56 GMT

Hi @AvesterFahimipour, thanks for reaching us using the Live Community.

I can't find that BIOC Rules in my tenant, only "Suspicious domain suffix" and some about "abnormal" or "suspicious" user agent.

Were you able to check our Required data sources doc for the Analytics alerts? Maybe some data source is missing to fill the dataset fields.

If this post answers your question, please mark it as the solution.

Re: Suspicious domain suffix with a rare user agent - Explanation

AvesterFahimipour — Fri, 03 May 2024 07:46:38 GMT

You can see it under variations
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Suspicious-domain-suffix

It does not mention anything about datasets and it is under XDR agent.

Re: Suspicious domain suffix with a rare user agent - Explanation

AvesterFahimipour — Wed, 26 Jun 2024 07:44:04 GMT

Hello Everyone it seems that Cortex has removed the alerts for now until they fix it.