topic Re: Rule list in Cortex XSIAM Discussions

Rule list

Vishal.raut — Thu, 22 Aug 2024 11:09:06 GMT

I would like to see a list of rules regarding the types of incidents I receive in XSIAM.

I am not talking about IOC/BIOC

Can anyone help with the path ?

Re: Rule list

afurze — Thu, 22 Aug 2024 14:13:49 GMT

Can you please clarify what you mean by rules? Are you asking for detection rules?

Re: Rule list

Vishal.raut — Thu, 22 Aug 2024 14:24:14 GMT

Whatever incidents are triggering into XSIAM console , on what basis it is triggered ?

Need to understand the logic behind that incident ?

Which conditions met to trigger that incident ?

So under incident details, is there any option to check incident triggered on which parameter (IP , URL, file etc)

example :

"Credentials gathering protection" incident - where i can find Rule logic for this incident.

Re: Rule list

afurze — Thu, 22 Aug 2024 14:30:58 GMT

This is a complex question. For alerts triggered by a correlation rule, the answer is simple, however, other detections require some analysis to understand what happened. The first place to start is with the Alert Name and Alert Description, these will give you more human-readable information about the alert. As an example, the Credential Gathering Protection module may fire alerts that have a description such as "Mimikatz pattern" or "MiniDumpWriteDump() on lsass.exe". Using this as a clue, we can open the Causality Card for the alert and investigate the chain, as well as the EDR data collected for the alert to understand what happened.

I would encourage you to reach out to your Customer Success team for a deeper dive discussion on this.