Authentication BIOC rule

[BenHooper]

Currently, I can create one-off or scheduled queries for authentication data / events but not BIOC rules which isn't ideal because scheduled queries don't create incidents.

Is it on the roadmap to add this ability?

Thanks.

[dfalcon]

Hi @BenHooper -

I will look into thee authentication option, although I won't be able to post roadmap information in the forums.  In the interim, have you tried leveraging an XQL with a BIOC based on those results?