BIOC Rules for OneDrive File Uploads | Exfiltration

[Melvin_Machado]

Hello,

I have encountered an issue where some users in my organization are uploading large files (around 100 GB) to their personal OneDrive accounts using public Microsoft domains. Currently, Cortex is allowing these actions without signaling them.

To address this, I created my own BIOC rules, which are functioning well :

preset = network_story
| filter dst_action_external_hostname in ("*.onedrive.com", "*.onedrive.live.com") and action_total_upload > 1000000

However, I'm facing two challenges:

1. Multiple alerts are being generated, but no Incident (INC) is being created.
2. How can I consolidate these alerts to generate only one alert (instead of 20) when a user uploads files to OneDrive?

I would appreciate your guidance on resolving these issues.

Thank you!

[jmazzeo]

Hi @Melvin_Machado, thanks for reaching us using the Live Community.

What is the severity configured to this custom BIOC rule? Only Medium to Critical alerts will generate an Incident, and if the host generating it is always the same, the alerts should be added to the same Incident.

If this post answers your question, please mark it as the solution.

[Melvin_Machado]

Hello Jmazzeo,

When I change the severity to Medium, it creates an incident and merges all the alerts as expected 🙂

However, I’m facing another issue now. An alert is being generated even when only 4 KB is uploaded.

I would like the system to trigger an alert only when more than 10 MB is uploaded. Could you help me adjust this setting?

Thank you!

[Melvin_Machado · Accepted solution]

Thank you for your help! I found a solution.

preset = network_story
| filter dst_action_external_hostname ="*.onedrive.com" or dst_action_external_hostname = "*.onedrive.live.com"
| filter action_total_upload > 10485760