topic Re: XQL/BIOC - web in Cortex XDR Discussions

XQL/BIOC - web

arekf — Fri, 14 Feb 2025 08:09:38 GMT

Hello,

Can you tell me in which dataset I can find the following data?

URL addresses
User Agent

With this information, can we create a rule that is based on defined values and then generate an alert based on it or block it within the Restriction Profiles?Can someone share such a query or rule.

Re: XQL/BIOC - web

aspatil — Mon, 17 Feb 2025 10:48:30 GMT

Hello @arekf ,

Thanks for reaching out on LiveCommunity!

Can you please help me with actual use case, what you are trying to achieve using XQL?

Regards,

Ashutosh

Re: XQL/BIOC - web

arekf — Tue, 18 Feb 2025 08:54:06 GMT

Hi,

I would like to develop bioc rules that allow triggering alerts based on specific User-agent values

Additionally, having a scenario where I receive a list of urls from outside, I indicate them as the rule value and during communication it is a trigger for an alert.