Analytic Bioc Rules

[NathanBradley]

Is there a way to see the actual detection of the analytic bioc rules

Normal bioc rules i can open in investigator but these i cannot

[jcandelaria]

Hi Nathan,

If you are looking for the actual xdr reference, below is the link where you can see the training period, learning period and description.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-...

Thanks

Jomar Candelaria

[NathanBradley]

That is a good resource but not exactly what im looking for

When clicking rules>bioc. When right clicking a rule, for example "Powershell reverse shell", and open in query builder.

    In query builder I can see its looking for remote port 4444 and cmd=*web*downloadstring*.ps1*|*web*downloadstring*.exe*

However when rules>bioc>analytic bioc rules. right clicking any rule and there is not an option to open in query builder

[jcandelaria]

Hi Nathan,

No that is possible to open in query builder as this is analytics rules, the reference that I posted is what explains that analytics rules.

Thanks

Jomar Candelaria