Create Alert from Data Lookup

[G.Anshar]

Hello everyone,
I have a reference dataset from IBM QRadar that I’ve stored as a lookup dataset. My goal is to create an alert if a malicious file is downloaded or opened. How can I achieve this or is it possible using BIOC?

[eluis]

Hello G.Anshar, 

Lookup dataset is not eligible to create BIOC on them. You can create correlation rules for the lookup data and please note that this is not normalised data so it does not qualify for stitching or log aggregation. Hence, malicious file detection cannot happen around the same, unless your lookup dataset has a field that classifies a specific log containing a filename or a file hash or any prooperty of file as malicious. This value can be filtered as a search criteria for your correlation rule and then you can query it. But since this is not a streaming data, alert generation is not possible. 

If you want to stream data from Qradar into Cortex XDR, you should have the Pro per GB license to ingest data to be streamed(1), the correlation rules written on that data finding the desired value/log(2), then the alerts/incidets being triggered(3).

I wonder why you want to raise an alert when a malicious file is attempted to be opened through querying a lookup dataset and BIOC rules if this is done already natively by the Cortex XDR agent and this should happen ideally on the basis of any logs being sent by the endpoints using Cortex XDR agent(only). 

Hope this suffices your query. Feel free to mark the response as "Äccepted as Solution" if it answered your query.