topic Monitor bitlocker in Cortex XDR Discussions

Monitor bitlocker

JPrezHidalgo — Mon, 27 May 2024 08:10:18 GMT

Hello,

I am checking if it is possible, to monitor from cortex when BitLocker is enabled on the computer, via a BIOC?

Best regards.

Re: Monitor bitlocker

aspatil — Mon, 27 May 2024 08:26:21 GMT

Hello @JPrezHidalgo ,

Thank you for reaching out on Live community.

Behavioral indicators of compromise (BIOCs) enable you to alert and respond to behaviors—tactics, techniques, and procedures. Instead of hashes and other traditional indicators of compromise, BIOC rules detect behavior such as is related to processes, registry, files, and network activity.

If you want to monitor the encryption status on the machines, you can refer to below query:
dataset = endpoints
|fields endpoint_name , endpoint_id , operating_system , encryption_status

You can create Dashboard or use correlation rule as per your need.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

Re: Monitor bitlocker

JPrezHidalgo — Mon, 27 May 2024 08:58:24 GMT

In this case, we do not need to see the encryption status (if applied by Cortex XDR), but to see when the bitlocker goes from inactive to active.

Re: Monitor bitlocker

aspatil — Thu, 30 May 2024 05:42:50 GMT

Hello @JPrezHidalgo ,

The idle way is to run manage-bde -status. However, if you want to be notified, I have found two ways here.

1. To look for the event id's when encryption starts and completes and create a correlation rule and get alerted.

2. Check with Microsoft which registries can be verified to ensure that encryption status changes and create the BIOC.

Or you can get the report in every specific time frame and ingest back into XDR and create the correlation rule. Please ensure you have pro per GB license for it.

Re: Monitor bitlocker

JPrezHidalgo — Thu, 30 May 2024 08:03:47 GMT

Hello,

Thank you very much for the answer, you are helping me enormously. The question is that the idea I had was to do what you said in point number 1.

But I can not identify in the telemetry the event that allows me to perform the correlation rule to warn us.

Thank you very much for your help.

Best regards.