Check IP reputation through IOC

[FabioFerreira]

Hi,

I need to create a XQL or something in Cortex XDR, where I get IP address from O365 logs and check if match with IOCs I have in Cortex XDR.

Could you help

Regards,

Fábio Ferreira

[timurphy]

Hi @FabioFerreira,

There aren't any built-in datasets that list all IOCs that have been entered into XDR at this time.

An option to consider is uploading a custom dataset (lookup) containing your IOCs, and then using the join stage to accomplish this. 

Regards,

Tim

[FabioFerreira]

Hi @timurphy 

Thank you for your answer.

I have more than 10k IOCs in XDR, I need to find a way to query this inside XDR if possible.

Can I create a custom dataset based on the IOCs that exists in Cortex XDR?

Or maybe export them and them import them through a script inside XDR and then get them into a new dataset ?