topic Re: Automatic Artifact Analysis in Forensic Investigation in Cortex XDR Discussions

Automatic Artifact Analysis in Forensic Investigation

Dzung_TranC — Mon, 17 Mar 2025 18:03:49 GMT

I have created and conducted some forensic cases on Cortex XDR, but one thing that has always intrigued me is the "Alert" tab in the Forensic Investigation section. Does this tab contain alerts generated by the automatic artifact analysis feature based on behavior rules? And how can I utilize this feature, as I have never seen any alerts appear in this tab?

Re: Automatic Artifact Analysis in Forensic Investigation

aspatil — Tue, 18 Mar 2025 07:36:43 GMT

Hello @Dzung_TranC ,

The purpose is to view any alerts triggered during data ingested as part of the investigation.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Manage-an-investigation

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Automatic Artifact Analysis in Forensic Investigation

Dzung_TranC — Tue, 18 Mar 2025 07:50:12 GMT

Thanks you for your time in this topic,

I performed triage and threat hunting across numerous machines, resulting in thousands of ingested files. While I'm certain there are suspicious activities present, no alerts were triggered. Are the rules used to trigger alerts for these files based on BIOC? Is it possible for me to write custom rules to trigger alerts for ingested files? Are there any prerequisites I need to fulfill before enabling this functionality?

Re: Automatic Artifact Analysis in Forensic Investigation

aspatil — Tue, 18 Mar 2025 09:43:11 GMT

Yes there should be detection rules in place. Eg. IOC

Re: Automatic Artifact Analysis in Forensic Investigation

Dzung_TranC — Thu, 20 Mar 2025 08:04:15 GMT

After a day of research, I understand that data is ingested into Cortex XDR using the Cortex XDR Forensics Add-on with forensics datasets. If I want to query this data, I need to call the datasets I highlighted in the image below. However, in BIOC, only the xdr_data and cloud_audit_log datasets can be used. Therefore, it's impossible to write BIOC rules for data from the Forensics Add-on and only IOCs can be used to create alerts for them. Is my understanding correct?

Thank you for taking the time for me.

Re: Automatic Artifact Analysis in Forensic Investigation

aspatil — Thu, 20 Mar 2025 12:08:24 GMT

Yes