Create an issue when FIM events detected

SeanDeHarris — Thu, 27 Aug 2026 04:08:45 GMT

Hello experts,

We plan to get the FIM module on top of my XDR.

Having set up with FIM Profile and Policy, we could be able to see those events successfully.

with the following information:

2. Dataset and Presets for FIM

Dataset: xdr_data
XQL Filter:dataset = xdr_data | filter fim_event = true

Console: Inventory → Endpoints → File Integrity Monitoring → Events

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/trigger-an-alert-by-email-for-file-integrity-monitoring-fim-add/m-p/1262195#M9503

Since this FIM event will be dependent on 5 mins heartbeat (to upload the telemetry to Cortex) , this would be late if we detected the deface of html.

So , the target we would like to trigger an issue when FIM events detected for instance notification.

We did a test a correlation rule, however, it would take up to max 15 mins (heartbeat + correlation rule triggering).

How can I use BIOCs rule for this?

Thanks,

SDG

Re: Create an issue when FIM events detected

SeanDeHarris — Thu, 27 Aug 2026 04:38:30 GMT

This is my correlation rule,

dataset = xdr_data
| filter fim_event = TRUE
| filter event_type = FILE and event_sub_type in (FILE_CREATE_NEW, FILE_WRITE, FILE_REMOVE, FILE_RENAME)
| fields _time, agent_hostname, event_sub_type, action_file_path, actor_process_image_path

| sort desc _time

Possible to change this to BIOC?

topic Re: Create an issue when FIM events detected in Cortex XDR Discussions

Create an issue when FIM events detected

Re: Create an issue when FIM events detected