topic Re: BIOC not supported in Cortex XDR Discussions

BIOC not supported

Rolando_Pena — Wed, 12 Mar 2025 17:22:00 GMT

Good afternoon,

I'm trying to create a BIOC rule that tells me when users are trying to access the wetransfer.com and dropbox.com DNS. To do this, I generated the following XQL. When run, it shows me the logs of the connections to these DNS.

dataset = xdr_data
| filter dns_query_name = "*wetransfer*" or dns_query_name = "*dropbox*"

This XQL works correctly, but when I write it in the BIOC rule, it gives me errors. First, it tells me I should include an Event_type. I modified the XQL and it looks like this:

dataset = xdr_data
| filter event_type = "STORY"
| filter dns_query_name = "*wetransfer*" or dns_query_name = "*dropbox*"

But when I run it, it tells me that BIOC is not supported.

Could you help me correct this XQL so that it works as a BIOC rule?

thanks

Re: BIOC not supported

jmazzeo — Fri, 14 Mar 2025 13:58:32 GMT

Hi @Rolando_Pena, thanks for reaching us using the Live Community.

Try this one:

dataset = xdr_data | filter event_type = ENUM.NETWORK and action_external_hostname in ("*wetransfer*","*dropbox*")

If this post answers your question, please mark it as the solution.

Re: BIOC not supported

Rolando_Pena — Tue, 25 Mar 2025 16:43:27 GMT

Hello, the XQL that worked for me to create the BIOC was this one:

dataset = xdr_data

| filter event_type = ENUM.STORY
| filter dns_query_name = "*wetransfer*" or dns_query_name = "*dropbox*"
|filter actor_process_image_name != "svchost.exe" or actor_process_command_line != "*svchost.exe*"

I filtered it so it wouldn't generate alerts with network services. After this, I generated an automation rule based on the BIOC alerts to stop the CGO from running on the processes. Thank you.