Detection of various open source apps

[Shahwaz_Md]

Hi All,

We want alerts to be triggered for various open-source applications like NodeJS, Nginx, Python, etc.

Kindly let me know how we can achieve this.

Thanks

[aleksandar.astardzhiev]

Hi @Shahwaz_Md ,

Can  you give a bit more information what you want to achieve?

What do you mean by detect open-source app? When process is started/executed? When installed? When generating traffic?

[Shahwaz_Md]

We want an alert/incident to be triggered when the process is started/executed.

[Shahwaz_Md]

Hi Aleksandar,

Kindly share any suggestions for this.

[bbarmanroy]

Hi @Shahwaz_Md you'll need to look at creating custom BIOC's to trigger alerts when the process is spawned. 
There's an excellent LiveCommunity threat that has been around for a while to detect such behavior (including blocking such executions) - you can read it here (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/blocking-file-execution-based-on-nameand...).


Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BI...