topic Re: BIOC that will close web browser while opening certain websites in Cortex XDR Discussions

BIOC that will close web browser while opening certain websites

JuliaUrbanska — Tue, 19 Nov 2024 13:56:04 GMT

I want to create a BIOC rule that will close web browser (ex. chrome) when I open certain websites (ex. facebook.com and instagram.com). I'm using Network BIOC and I managed to create BIOC rule that applies only to one website (remote host) but I don't see the option where I can add multiple websites (remote hosts). Can you help me with that? Maybe there is another way to create that BIOC rule.

Re: BIOC that will close web browser while opening certain websites

jmazzeo — Tue, 19 Nov 2024 14:46:56 GMT

Hi @JuliaUrbanska, thanks for reaching us using the Live Community.

You can use the "in" operator to lookup in a list of strings.

Example:

dataset = xdr_data | filter event_type = ENUM.NETWORK and action_external_hostname in ("facebook.com", "instagram.com", "linkedin.com", "x.com")

If this post answers your question, please mark it as the solution.