Cortex XDR Custom Prevention Profiles

[MarvinC]

Hi Palo Alto Team and Community!

I am recently working on Custom Prevention Rules on Restriction Profiles on Cortex XDR. 

I understand that I need to create user defined BIOC then attach it to a Restriction Profile for it to be a custom prevention rule where I can set it to Block as intended. 

The problem here is, there are some BIOC that I cannot attach to a Restriction Profile such as BIOC with a hash an external IP address. 

Are there limitations to user defined BIOC for it to be attached to a Restriction Profile?

I managed to create a user defined BIOC that I have successfully attached to a Restriction Profile (e.g. A file create and write user defined BIOC).

Would be interesting to know the limitations.

[bbarmanroy]

Hey @MarvinC there are two use cases you seem to be aiming at. Let me address them individually:
1. blocking hashes - one option is to add them to the global Block list. In this case, hope this helps:

2. Blocking IP addresses: You can use Host Firewalls (recommended and easily managed). Alternately, use BIOC's .

[MarvinC]

Hi bbarmanroy,

Appreciate your help.

In cases that hose firewall is not in use, we have tried BIOC yet it is not
applying to restriction profile when we are including IP addresses as a
criteria.