Changing Analytics and BIOC Analytics Rules Severity and Configuring the Agent to Block

[michaelsysec242]

Hello all,

I have identified that the Analytics and BIOC Analytics is identifying real threats yet no action has been initiated due to the log source. Is it possible to increase the severity of these rules to Medium and higher ? 

Secondy, is it possible to set the policy to block when identifying these specific rules on the XDR Tenant?

From what I understand of these rules is that due to the fact that they are built-in rules that are provided by PAN they cannot be altered or their conditions cannot be viewed. What can I do in order to allow the agent to actively target these threats?

Cortex XDR 

[jcandelaria]

Is it possible to increase the severity of these rules to Medium and higher? Yes, you can manually change the incident severity by clicking on the three dots on the top right corner and select change severity.

Note: You cant change the actual rule severity that initially triggered the alert.

Is it possible to set the policy to block when identifying these specific rules on the XDR Tenant? No since these are analytics rules, but what you can do is investigate this analytics/bioc analytics alerts and create your custom BIOC rule based on your investigation/criteria then you can assign that custom bioc rule as prevention rule which you need to apply to restriction profile.

From what I understand of these rules is that due to the fact that they are built-in rules that are provided by PAN they cannot be altered or their conditions cannot be viewed. Correct

What can I do in order to allow the agent to actively target these threats? What you can do is investigate this analytics/bioc analytics alerts and create your custom BIOC rule based on your investigation/criteria then you can assign that custom bioc rule as prevention rule which you need to apply to restriction profile.

Reference: Configure Custom Prevention Rule:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BI...

https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/custom-prevention-rules/ta-p/347271