Cortex XDR Pro - Uploading IOCs - also working retrospectively?

[RFeyertag]

Hello dear community, 

I've read something about uploading IOCs and I would like to know, if they also work retrospectively? 

How else? 

Do I create/upload an IOC and these will only be triggerd, when this IOC is seen in the future?

Here are some information from the documentation? But like you can see: 

BR 

Rob

[etugriceri · Accepted solution]

Hi @RFeyertag 

its working retrospectively and if its detect something, You'll have an alert like below. 

[RFeyertag]

Hello @etugriceri! 

Thank you so much for this clarification!

Then I will start my little project, to download some TI and upload it to Cortex XDR Pro. 

If there are any ressources for uploading IOCs directly from other sources to Cortex, I'd would be appreaciate. 

BR

Rob