- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-15-2025 02:28 PM
Hello Palo Alto LiveCommunity,
I’m currently working on a task where I need to create a custom BIOC (Behavioral Indicator of Compromise) and add it to a restriction profile to block FTP command lines. Specifically, I want to prevent FTP-related commands from being executed by monitoring and restricting certain patterns.
I also need help with incorporating the following regex expression into the scope of action for a remote IP
it would be very appreciated if you have more details of how the BIOC must be created to block a process when it's associated with a restriction profile
An additional question is how BIOCs work when added as a Prevention Rule in a Restriction Profile.
I can see that some rules can generate locks killing the process, and others only detect, does anyone know how this capability works?
01-15-2025 08:45 PM
Hello @J.Gammara
Thanks for reaching out on LiveCommunity!
With BIOC rules, you can configure custom prevention rules to terminate the causality chain of a malicious process according to the Action Mode defined in the associated Restrictions Security Profile and trigger Cortex XDR Agent behavioral prevention type alerts in addition to the BIOC rule detection alerts.
For example, if you configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block, the Cortex XDR agent:
Blocks a process at the endpoint level according to the defined rule properties.
Triggers a behavioral prevention alert you can monitor and investigate in the Alerts table.
For more information on how to create a BIOC rule, please refer below doc.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Create-a-BIOC-rule
You will find information on how to make a customer prevention rule using BIOC under heading "Configure a custom prevention rule".
Please click Accept as Solution to acknowledge that the answer to your question has been provided.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!