Create an issue when FIM events detected

[SeanDeHarris]

Hello experts,

We plan to get the FIM module on top of my XDR. 

Having set up with FIM Profile and Policy, we could be able to see those events successfully.

with the following information:

2. Dataset and Presets for FIM

• Dataset: xdr_data
• XQL Filter:dataset = xdr_data | filter fim_event = true

• Console: Inventory → Endpoints → File Integrity Monitoring → Events

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/trigger-an-alert-by-email-for-file-integ...

Since this FIM event will be dependent on 5 mins heartbeat (to upload the telemetry to Cortex) , this would be late if we detected the deface of html.

So , the target we would like to trigger an issue when FIM events detected for instance notification.

We did a test a correlation rule, however, it would take up to max 15 mins (heartbeat + correlation rule triggering). 

How can I use BIOCs rule for this? 

Thanks,

SDG

[SeanDeHarris]

This is my correlation rule, 

dataset = xdr_data
| filter fim_event = TRUE
| filter event_type = FILE and event_sub_type in (FILE_CREATE_NEW, FILE_WRITE, FILE_REMOVE, FILE_RENAME)
| fields _time, agent_hostname, event_sub_type, action_file_path, actor_process_image_path

| sort desc _time

Possible to  change this to BIOC?

[susekar]

Hello @SeanDeHarris ,

Greetings for the day.

Yes, you can convert the core filtering logic of your correlation rule into a BIOC (Behavioral Indicator of Compromise) rule.

-BIOC rules evaluate raw event streams in real time as events are ingested instead of running on a recurring schedule like Correlation Rules, which reduces detection delay once telemetry arrives.

Key Differences & Constraints for BIOC Rules:

• Supported Stages: BIOC queries only support the filter and alter stages, along with scalar functions without aggregations. Stages such as fields, sort, comp, or join are not supported.
• Mandatory Filter: A BIOC query must include a filter on the event_type field.
• Case Sensitivity: BIOC rule field values in XQL are case-insensitive by default (config case_sensitive = false).
• Severity & Incident Generation: Setting the severity to Medium or higher ensures that matches automatically generate incidents/cases in Cortex XDR.
  
  

Converting the Query

From the original correlation rule:

• Remove the fields stage.
• Remove the sort stage.
• Keep dataset = xdr_data and the relevant filter conditions on event_type and file attributes.

Example BIOC Query:

dataset = xdr_data
| filter event_type = ENUM.FILE and event_sub_type in (ENUM.FILE_CREATE_NEW, ENUM.FILE_WRITE)
| filter action_file_path contains "<SPECIFIC_TARGET_PATH>"

Replace <SPECIFIC_TARGET_PATH> with the targeted file directory or exact path.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[susekar]

In addition.

Sharing the steps to Create the BIOC Rule in Cortex XDR

1. Go to Detection Rules → BIOC.
2. Click + Add BIOC and select XQL Search.
3. Enter the formatted XQL query and click Test BIOC.
4. Define the rule name, type, and severity.
5. Set severity to Medium or High if you want an incident/case to be created.
6. Optionally map the relevant MITRE ATT&CK tactics and techniques.
7. Click OK / Save.

Once saved, Cortex XDR performs an initial backwards scan (up to 10,000 matches) and continues real-time alerting on newly incoming telemetry.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar