Cortex XDR Analytics BIOC Rules' Severity

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Cortex XDR Analytics BIOC Rules' Severity

L0 Member

I am writing to inquire about the procedure for modifying the severity levels of BIOCs (Behavioral Indicators of Compromise) within the Analytics module of Cortex XDR. Specifically, we are looking to understand how to create or adjust a custom rule where we can manually add a BIOC and select its severity level according to our needs.

Could you please provide guidance or documentation on how to achieve this? Detailed instructions or any relevant steps to create or modify such a rule would be greatly appreciated.

1 accepted solution

Accepted Solutions

L4 Transporter

yes @Fm12345 

The automation rule is a good idea

The rule is similar like that

Alejandro_Hernandez_0-1723039623042.png

 

PCSPI, PCNSCx3,PCNSEx4,, PCSAE,PCDRA, ISC2 CC

View solution in original post

5 REPLIES 5

L4 Transporter

Hi @m.seyid 

When you created a BIOC rule

In Detection Rules > BIOC > Right click over BIOC rule and select edit

And here you  will change the severity 

Alejandro_Hernandez_0-1722869371789.png

 

PCSPI, PCNSCx3,PCNSEx4,, PCSAE,PCDRA, ISC2 CC

L0 Member

Hi Alejandro_Hernandez,

Thank you for your response. However, what I need to change is not the BIOC itself, but the severity of the Analytics section.

I can show you this picture as an example

XDRANALYTİCS.png

 

L4 Transporter

Hi @m.seyid 

Checking the Analytics BIOC rules, here is not possible to modify the severity

The only way to modify is when the alert is generated and set the new severity

Alejandro_Hernandez_0-1722966878554.pngAlejandro_Hernandez_1-1722966926432.png

 

PCSPI, PCNSCx3,PCNSEx4,, PCSAE,PCDRA, ISC2 CC

L1 Bithead

Yes..as @Alejandro_Hernandez  mentioned it's not possible to edit analytics biocs or BIOCs from source as paloalto.

 

Instead you can create automation rule and set criteria on alert name or combination of alert names and hosts etc.. the action of the automation can be to change severity. So that when such alert comes in the severity is set as per your requirement.

L4 Transporter

yes @Fm12345 

The automation rule is a good idea

The rule is similar like that

Alejandro_Hernandez_0-1723039623042.png

 

PCSPI, PCNSCx3,PCNSEx4,, PCSAE,PCDRA, ISC2 CC
  • 1 accepted solution
  • 862 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!