topic Re: Alert generation / Test cases/samples for Cortex XDR protection module testing in Cortex XDR Discussions

Alert generation / Test cases/samples for Cortex XDR protection module testing

tejaspatil12 — Thu, 29 Aug 2024 05:57:48 GMT

Hello Team,

Could anyone assist with generating alerts and creating test cases or samples for testing the Cortex XDR protection module?

We successfully generated an alert using a WildFire PE file, but we now need to generate alerts for each policy module, for example Local Analysis, Behavioral Threat Protection, and Exploit Protection.

If you have any information or details on this, your help would be greatly appreciated.

Thanks in advance.

Re: Alert generation / Test cases/samples for Cortex XDR protection module testing

nsinghvirk — Thu, 29 Aug 2024 17:44:31 GMT

Hello @tejaspatil12

Thanks for reaching out on LiveCommunity!

Unfortunately there is no document that contains all trigger/sample malware to generate alerts for all policy modules. You can create test IOC or BIOC rules and trigger them to see alerts related to IOC/BIOC. Additionally you can create double extension files or rename an application to a system process name to trigger BTP rules etc. Similarly you can create similar scenarios with respect to other modules to trigger alerts.

Re: Alert generation / Test cases/samples for Cortex XDR protection module testing

S.Pamarthi033068 — Wed, 14 May 2025 15:16:37 GMT

Hello @nsinghvirk

Hello,

i'm trying to generate a test alert in cortex xdr. i have created BIOC rule and added it to prevention profiles. i couldn't see the alert in the alert table. can you help me, what's missing.

It would be really great if you help me with this issue.

Best Regards

Sri

Re: Alert generation / Test cases/samples for Cortex XDR protection module testing

nsinghvirk — Wed, 14 May 2025 15:33:37 GMT

Hello @S.Pamarthi033068 ,

Have you tried imitating the behaviour for which you created the BIOC rule on an endpoint on which the same prevention profile is enforced?

Please share the BIOC rule details that you have created.

Re: Alert generation / Test cases/samples for Cortex XDR protection module testing

S.Pamarthi033068 — Wed, 14 May 2025 15:40:54 GMT

Hello @nsinghvirk

Thanks for the reply.

This is the rule i have created.

And then moved to policy management profile