Custom BIOC Rule won't apply to Prevention Profile

M.McClure — Fri, 20 Feb 2026 19:18:47 GMT

We are attempting to make a custom BIOC rule to prevent the use of certain softwares on our servers. Applying the BIOC to a prevention profile works, except for when we add any exceptions. Say we are attempting to block Google Chrome on servers, we add an exception for a prefix used for end user device names and the BIOC can no longer be applied to any prevention rule. Am I missing something? Is this a bug perhaps?

Re: Custom BIOC Rule won't apply to Prevention Profile

susekar — Thu, 26 Feb 2026 13:21:23 GMT

Hello @M.McClure ,

Greetings for the day.

The behavior you are experiencing is a design limitation of Cortex XDR and not a bug. When a Behavioral Indicator of Compromise (BIOC) rule is added to a Restrictions Profile for prevention, it is converted into a rule that must be evaluated locally by the Cortex XDR agent on the endpoint.

To ensure the agent can enforce these rules in real time without relying on server-side context, certain fields are prohibited in the BIOC query logic. Adding an exception based on Host Name (or device name prefixes) makes the rule ineligible for prevention enforcement, causing it to disappear from selection lists or lose the "Add to restrictions profile" option.

Prohibited Fields for Prevention BIOCs:

A BIOC rule cannot be applied to a prevention profile if it contains any of the following fields:

All Events: Host Name (this is likely what is triggering your issue).
File Events: Device Type, Device Serial Number.
Process Events: Device Type, Device Serial Number, User Name.
Network Events: Country, Raw Packet.
XQL Specific: Complex operators like contains or in used with wildcards (*) are often unsupported; use regex (~=) instead.

Alternative for Google Chrome:

If your goal is specifically to block Chrome, it is often recommended to use the Add to Block list feature within the Restriction Profile directly, adding the executable names (for example, chrome.exe, ChromeSetup.exe) rather than using a behavioral BIOC. BIOCs are asynchronous and may allow initial execution before terminating the process.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: Custom BIOC Rule won't apply to Prevention Profile in Cortex XDR Discussions

Custom BIOC Rule won't apply to Prevention Profile

Re: Custom BIOC Rule won't apply to Prevention Profile

Prohibited Fields for Prevention BIOCs:

Recommended Solution:

1. Modify the BIOC Rule:

2. Add to Restriction Profile:

3. Use Policy Management for Scoping:

Alternative for Google Chrome: