Create an issue when FIM events detected

[SeanDeHarris]

Hello experts,

We plan to get the FIM module on top of my XDR. 

Having set up with FIM Profile and Policy, we could be able to see those events successfully.

with the following information:

2. Dataset and Presets for FIM

• Dataset: xdr_data
• XQL Filter:dataset = xdr_data | filter fim_event = true

• Console: Inventory → Endpoints → File Integrity Monitoring → Events

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/trigger-an-alert-by-email-for-file-integ...

Since this FIM event will be dependent on 5 mins heartbeat (to upload the telemetry to Cortex) , this would be late if we detected the deface of html.

So , the target we would like to trigger an issue when FIM events detected for instance notification.

We did a test a correlation rule, however, it would take up to max 15 mins (heartbeat + correlation rule triggering). 

How can I use BIOCs rule for this? 

Thanks,

SDG

[SeanDeHarris]

This is my correlation rule, 

dataset = xdr_data
| filter fim_event = TRUE
| filter event_type = FILE and event_sub_type in (FILE_CREATE_NEW, FILE_WRITE, FILE_REMOVE, FILE_RENAME)
| fields _time, agent_hostname, event_sub_type, action_file_path, actor_process_image_path

| sort desc _time

Possible to  change this to BIOC?