topic Add large IOC to block list in Cortex XDR Discussions

Add large IOC to block list

tlmarques — Thu, 26 Sep 2024 15:30:08 GMT

Guys,

I need your help, I need to upload 500 IOCs to the block list.
Is there any option to upload IOCs in bulk or I have upload one by one?

Re: Add large IOC to block list

jmazzeo — Thu, 26 Sep 2024 15:33:40 GMT

Hi @tlmarques, thanks for reaching us using the Live Community.

When you create the IOC in Detection Rules -> IOC, you click on Add IOC and you have the option to upload many entries using a file, and you have a sample file to create it with the correct format.

If this post answers your question, please mark it as the solution.

Re: Add large IOC to block list

tlmarques — Fri, 27 Sep 2024 16:02:51 GMT

Hi @jmazzeo
but when i uploaded on IOCs , the IOC is not blocked, but only appear alerts on XDR correct??

Re: Add large IOC to block list

tlmarques — Fri, 27 Sep 2024 18:09:40 GMT

I tested inserting IOCs marked as critical and with bad reputation. Cortex XDR automatically created multiple incidents/alerts, but the action taken was "detect" rather than "prevent," which is what I need.

Do you have any other suggestions on how to achieve this?

Re: Add large IOC to block list

jmazzeo — Fri, 27 Sep 2024 18:22:09 GMT

The IOC list is only to for detection. If you need to block the hashes execution you need to add them to a Block List under Incident Response - Response - Action Center -> Block List.

I highly recommend you the Alert Tuning webinar that was published in last April this year: https://live.paloaltonetworks.com/t5/cortex-xdr-webinars/cortex-xdr-customer-success-webinar-series-part-1-alert-tuning/ta-p/584842

If this post answers your question, please mark it as the solution.

Re: Add large IOC to block list

tlmarques — Fri, 27 Sep 2024 18:44:15 GMT

Yes, as I mentioned... I need to upload 500 IOCs to block...
Is there a bulk process?
I don’t think so...

Re: Add large IOC to block list

jmazzeo — Fri, 27 Sep 2024 18:47:27 GMT

Yes, you can add 100 at the same time from the console:

Or you can use the API: https://cortex-panw.stoplight.io/docs/cortex-xdr/1a1950467783e-block-list-files