Multiple Queries regarding cortex XDR

[Shashanksinha]

Hello, 

Is it possible to know the following :

        1. Whether BIOC rules generate alerts/incidents in case there is a match for Custom prevention rules.

        2. Any method to bulk hash blocking using Action center.

        3. If we are hosting XDR firewall simultaneously, can we host another firewall from other tools . 

[bbarmanroy]

Hi @Shashanksinha the answers are

1. Yes

2. Yes you can enter multiple entries in one go using Action Center

Alternately, you can also use API's as that eliminates the need to copy-paste one at a time. You can then leverage the ability to ingest multiple entries, one at a time, each with their own comments.

3. You can take a look at the list here and see if this meets your requirements (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/external-data-ingestion/abo...).

[Shashanksinha]

Hello, 

Thanks for the response . 

I wanted to ask instead of adding one-by one .Is there any method to upload it through some sheet without copy-pasting one by one 

Like we can add IOC in the XDR console in bulk uploading notepad file or csv file . 

[bbarmanroy]

Hi @Shashanksinha that's not possible now. The workaround is to use the API via a programming language or scripting language of your choice or use the Cortex XDR Postman API collection to perform the same.

Take a look at the detailed walkthrough of how to configure Postman to do the action you're asking for. 

Ref: https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-postman-api-collection/ba-p/443845