Agent Blocking files/processes dynamically based on conditions

[michaelsysec242]

Hello XDR Enthusiasts,

I am working with multiple XDR Tenants and would like to block a file/process based on conditions. I understand that you can use the Prevention features to block files based on a block/black list. This can also be configured on the Malware Profile settings where specific severity incidents can induce the agent to block the file automatically.  My question is; Is it possible to configure conditions for the Agent to stop a file? For example only when a filename does not equal X then block it? 

I thought of two solutions, yet I am not sure that they will be suitable;

1. To create a BIOC rule with a critical severity or similar in order that the block rule can be determined on policy based on its severity. I am not sure that the XDR has this capability. 
2. I am working with a Production Level Cortex XSOAR, is there a playbook or automation that can be implemented to block the file during it's runtime? Due to the time delta between the agent identifying and the XSOAR running a playbook there will be a delay.

I would be interested to know whether the XDR Agent blocking abilities can be set to default based on rules. 

Many thanks,

MR

Cortex XSOAR 

Cortex XDR 

[bbarmanroy]

Hi @michaelsysec242 the ability to create custom BIOC to terminate an execution should do the trick. Please look into this LiveCommunity post where the solution has been explained.