Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block

[tejaspatil12]

Hello team,

Does Cortex XDR BIOC analytics alerts get blocked after setting Global Behavioral Threat Protection to block ? or how Cortex XDR decide to block/detect the behavioral threat alert?

Cortex XDR 

[nsinghvirk]

Hello @tejaspatil12 

Thanks for reaching out on LiveCommunity!

Analytics BIOC alerts are for detect/alert purpose they do not provide block functionality. Analytics BIOCs are not produced in real time and therefore cannot block. Please take a look at the Analytics Concepts. for a better understanding of how analytics work.  Essentially it's looking at a lot of different factors after the event to determine the larger picture.

By looking into the activity that caused the alert you may be able to find similarities you can use to create a high fidelity BIOC and then you can configure BIOC rules as custom prevention rules and incorporate them with your Restrictions profiles.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit...

Please click Accept as Solution to acknowledge that the answer to your question has been provided.