If you are looking for the actual xdr reference, below is the link where you can see the training period, learning period and description.
That is a good resource but not exactly what im looking for
When clicking rules>bioc. When right clicking a rule, for example "Powershell reverse shell", and open in query builder.
In query builder I can see its looking for remote port 4444 and cmd=*web*downloadstring*.ps1*|*web*downloadstring*.exe*
However when rules>bioc>analytic bioc rules. right clicking any rule and there is not an option to open in query builder
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!