Bioc rules (XQL query)

Ajhuge — Mon, 20 Feb 2023 06:41:13 GMT

Hello everyone. I need help about bioc rules. I found a lot of ioc rules from other source. But I dont know how can I change that ioc rules to BIOC rules. Thats really so big problem for me and I can't figure out. Who can help me about that? Thanks in advance.

Re: Bioc rules (XQL query)

aleksandar.astardzhiev — Wed, 01 Mar 2023 09:04:31 GMT

Hi @Ajhuge ,

Can you please clarify what are you trying to achieve?

I am probably missing your point, but IOC and BIOC are two different thinks:

- IOC are "static" indicator like known bad IP, domain, file hash, file name etc. XDR allow you to manually add IOC one at time, or bulk import from file. Working with IOCs • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

- BIOC are behavior indicator, where using XQL query you can define what behaviors/actions/series of related actions could be suspicious. Working with BIOCs • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

You don't need to create BIOC to look for IOC. XDR will raise alert whenever defined IOC is detected.

If you want to import IOC from external Threat Intelligence, unfortunately XDR doesn't support "polling" IOC from external source. However you can "push" IOC to XDR using the Rest API - as mentioned in above links this option is available only for Pro per Endpoint license

Re: Bioc rules (XQL query)

TamikaGunter — Mon, 13 Mar 2023 13:22:16 GMT

Thanks for the links, and if I still face any issue, I will message you.

topic Bioc rules (XQL query) in Advanced Threat Prevention Discussions

Bioc rules (XQL query)

Re: Bioc rules (XQL query)

Re: Bioc rules (XQL query)