Hunting for Keywords - How to do that in Cortex xdr Pro?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Hunting for Keywords - How to do that in Cortex xdr Pro?

L4 Transporter

Hello dear community, 

 

how could this keywords be integrated into cortex xdr pro?

 

https://mthcht.github.io/ThreatHunting-Keywords/

 

happy hunting!

 

BR

 

Rob

3 REPLIES 3

L4 Transporter

Hi @RFeyertag,

 

If you're wanting to set up detection rules these keywords there are a few ways you could do it.  

 

You could use a custom script and interface with the API.  Although a simpler method might just be to add these as appropriate BIOCs.

 

Let me know if you like either of these ideas.

Do you think this BIOC creation could be done by the experts from PA/Cortex XDR team?

 

BR

 

Rob

 

L4 Transporter

I believe some of these are currently protected out of the box with Cortex XDR and it's always possible more will be added in future content updates.  Unless you've tested and confirmed I'd suggest adding them as BIOC's as each organization has different needs.

  • 1124 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!