Analytic Bioc Rules

cancel
Showing results for 
Search instead for 
Did you mean: 

Analytic Bioc Rules

L1 Bithead

Is there a way to see the actual detection of the analytic bioc rules

Normal bioc rules i can open in investigator but these i cannot

3 REPLIES 3

L2 Linker

Hi Nathan,

 

If you are looking for the actual xdr reference, below is the link where you can see the training period, learning period and description.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-...

 

Thanks

Jomar Candelaria

That is a good resource but not exactly what im looking for

When clicking rules>bioc. When right clicking a rule, for example "Powershell reverse shell", and open in query builder.

    In query builder I can see its looking for remote port 4444 and cmd=*web*downloadstring*.ps1*|*web*downloadstring*.exe*

        

 

However when rules>bioc>analytic bioc rules. right clicking any rule and there is not an option to open in query builder

    

Hi Nathan,

 

No that is possible to open in query builder as this is analytics rules, the reference that I posted is what explains that analytics rules.

 

Thanks

Jomar Candelaria

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!