Is it possible to block IOC from Cortex XDR?

[hpatel11]

I'm trying to block domain across in our environment. I don't want to use url filtering on PA FW, but I want to use XDR IOC to block it. is possible to do it? 

[afurze · Accepted solution]

Hi Hpatel11,

Unfortunately, no, it is not possible to block IOCs with Cortex XDR directly, the IOCs exist only on the XDR server and are not sent to the agents.  If you are an XDR Pro per Endpoint or Pro per TB customer, you can set up External Dynamic Lists and have your NGFW subscribe to those lists to automatically update your firewall policy directly from XDR.  

[hpatel11]

I figured. Thanks! 

[eluis]

Hi @hpatel11 

if IOCs are hashes you can block them adding them to the block list

Then as Afurze mentioned you can add other IOCs or internet web-sites to the EDLs so you can block them on your FWs

Other indicators like malicious email senders can be added (by your own procedures) to email server black lists... 

Think of other tools you might have at your organization in order to appropriately block all kinds of IOCs

I hope this helps, 
Luis 

[Cyber1985]

I did this in my poc(long time ago), I blocked like www.heise.de through BIOC with restriction rule. 

When I surfed on this webpage the whole browser got closed. 

If you want I can repeat it in my cortex xdr pro per endpoint Environment. 

[hpatel11]

I checked on BIOC but don't see anything for Domain. I see that we can do by IP.

[Cyber1985]

Have you tried to take a network query to view which field the domain is called? 

[hpatel11]

Got it it's called action_external_hostname Let me try to use this. 

[hpatel11]

I was able to create BIOC but can't associate BIOC with prevention policy. It's not syntax issue because I was able to trigger alert on it. 

[RFeyertag]

I think you need to do this from BIOC perspective. Not from the alert/incident perspective. 

[hpatel11]

This is only option that we got.

[RFeyertag]

So the guys from PA are right. You can only prevent with BIOC the processes. 

At the moment I cannot say why it worked at my POC. I remember, when I opened the page the whole browser went down. 

[RFeyertag]

and by the way, you can add process BIOCs through right clicking and add to restriction profile. 

[neelrohit]

@Cyber1985 , please be notified that it is a process activity using network connection to destinations for incoming, outgoing and failed connections only. There is still a possibility for raw packets which is not something can be blocked using Cortex XDR. 

Additionally, the BIOC rule as resriction actually blocks your browser process action and repetitive actions like these can be risky leading to crashing of the application itself and you might have to reinstall the application again.

[RFeyertag]

Thank you very much for this information! I can remember that in my test the complete browser was "closed" automaticly.