Create widget for bioc and ioc rule numbers

ZuleyhaAy — Tue, 08 Aug 2023 12:13:01 GMT

Hello everyone,

I am trying to get numbers of bioc and ioc rules from our xdr integration. I want to create a widget to see that how many ioc and bioc rules added week by week. Do anyone have idea for this?

Thanks in advance.

Re: Create widget for bioc and ioc rule numbers

gyldz — Mon, 21 Aug 2023 10:25:08 GMT

Hi @ZuleyhaAy ,

Unfortunately, there is no OOTB command to get the rules. However, you can make use of xdr-get-audit-management-logs command. If you are heavily creating rules, please check the commands limitation for example for limit parameter, it says "

limit: Maximum number of audit logs to return per page. The default and maximum is 30." I am pasting here a sample script which could get the number of created BIOC rules and if you want to develop something else please use the below resources.

res = demisto.executeCommand("xdr-get-audit-management-logs", {"type": "Rules", "sub_type":"CREATE"}) count = 0 for rule in res[0]["Contents"]: if 'BIOC created' in rule['AUDIT_DESCRIPTION']: count += 1 demisto.results(count)

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Script-Based-Widgets-Using-Automation-Scripts-Examples

I hope this answers your question.

topic Re: Create widget for bioc and ioc rule numbers in Cortex XSOAR Discussions

Create widget for bioc and ioc rule numbers

Re: Create widget for bioc and ioc rule numbers