Creating BIOC Rule for Large FTP Sessions

[GoatBloke]

Hi Everyone,

I'm new to Cortex XDR and looking to enhance our network security alerts. I want to create a BIOC rule that triggers an alert whenever a data transfer larger than 100MB occurs between two devices (Local IP to Remote IP). This will help us monitor potentially malicious data transfers or data exfiltration.

While we receive XDR Analytic Alerts for certain applications like Microsoft Teams uploading large amounts of data to remote servers, I'd like to implement a similar alerting mechanism for FTP/SFTP or any file transfer protocol.

Currently, I'm using a query example from the Query Library (attached), but it's not providing results for FTP. It works when I replace "FTP" with "SMB" or other protocols.

Is there something I'm missing, or do I need to set up the FTP Collector apllet on the BrokerVM to achieve this goal?

Your insights and guidance would be greatly appreciated.

Thanks in advance!

Just to clarify: I want an alert when data uploaded/downloaded is more than a certain size displaying Local and Remote IP table.

[jtalton · Accepted solution]

Hi GoatBloke, 

There is an existing Analytics alert for Large Upload (FTP) where our analytics engine identifies anomalous upload activity outside of the activity baseline established for the endpoint. 

The Cortex XDR - Analytics alerts are detect-only and are heavily dependent upon receiving logs from network devices that would have been involved in transmitting the exfiltrated files. Please ensure that you have the appropriate license and onboarded NGFW logs to your tenant. Ingesting logs from Next-Generation Firewall requires a Cortex XDR Pro per GB license.

In regard to the XQL query, please note not all BIOCs can be applied as Custom Prevention Rules. Reference Create a BIOC Rule • Cortex XDR Pro Administrator Guide

The following describes the event_type values for which you can create a BIOC rule.

• FILE—Events relating to file create, write, read, and rename according to the file name and path.
• INJECTION—Events related to process injections.
• LOAD_IMAGE—Events relating to module IDs of processes.
• NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.
• PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.
• REGISTRY—Events relating to registry write, rename and delete according to registry path.
• STORY—Events relating to a combination of firewall and endpoint logs over the network.
• EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.

Also, here is a LIVEcommunity walkthrough video on how to create custom prevention rules via BIOC’s: https://live.paloaltonetworks.com/t5/cortex-xdr-videos/custom-prevention-rules/ta-p/347271

If you found this response helpful, please Like and select Accept as Solution. 

Thank you!