Cortex XDR Incidents

[Vinothkumar_SBA]

Hi Team,

How can I create a BIOC rule for large upload activities of more than 1 GB of data in external storage? Please share your input.

[mavega]

Hi,

Thanks for reaching our Live Community.

For this, I would recommend a correlation rule instead, you can use the below query as an example (you will need to modify it to fit your needs):

dataset = xdr_data
| filter event_type = ENUM.NETWORK and action_external_hostname in ("mail.google.com", "drive.google.com", "etc... any additional external resource you need to add")
| bin _time span=1d
| comp sum(action_total_upload) as uploaded_bytes, values(action_external_hostname) as domain_names by agent_hostname, actor_effective_username, _time
| filter uploaded_bytes > 1000000000

The below link shows you how to create a correlation rule:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-Co...

If this solution solves your inquiry, please mark it as solved.

Regards.