The below article can best explain you the logic behind all the ABIOC rules setup in Cortex.
In general, informational alerts will only show up when an incident is triggered and get stitched with other alerts as part of insights in an incident to help better understand the incident.
Speaking for myself, if we start investigating into informational alerts then we will end up chasing false positives but there might be cases where your investigation might lead to a possible suspicious activity.
In order to find the suspicious activity you will first need to know some start point. For example:
In this cases we are looking for a command called "net user" (we created a BIOC rule to detect this command as informational). So lets say the query returned a result from there on we dig into the causality chain and then click on the process itself and then see the activity for alert as informational. (Not the best way to look for informational alert but does the trick.) You can use a similar logic to find ABIOC informational alerts.
Thank You.
Im looking for a way to either see the events that caused the analytic bioc to fire
or a way to view the query behind the rule
For example the rule below has 7 alerts
