Real-Time BIOC Detection and Playbook Execution for SSH/RDP Sessions

[.522643]

Hello,

I am working on a Playbook to detect RDP/SSH communications between servers and automatically terminate the corresponding process when such communication is detected.

As a preliminary test, I have configured a small-scale test to verify that the process can be automatically terminated. My current configuration is as follows.

1. XDR Environment

• Product: XDR Pro
• Test environment: Windows → Windows SSH communication
• SSH Client: MobaXterm

2. Test BIOC Rule

dataset = xdr_data
| filter event_type = ENUM.NETWORK
| filter action_remote_port = 22
    and actor_process_image_path contains "D:\Program\MobaXterm_Portable_v26.0"

The above BIOC Rule is designed to detect SSH communication generated by MobaXterm.

3. Playbook Configuration

The Playbook receives the following values from the Issue Event generated by the BIOC Rule:

• ${issue.agentid}
• ${issue.actorprocessinstanceid}

I am using the following action to terminate the process:

Cortex Core - IR | core-terminate-process

I also tested the Playbook through the Debugger Panel by specifying a generated Issue, and confirmed that the target process was successfully terminated.

4. Current Issue

When I actually establish an SSH connection for testing, the Issue Event generated by the BIOC Rule is created approximately 1–5 minutes after the SSH session has already been terminated.

Therefore, the Playbook is executed only after the session has already ended, which does not meet the intended purpose of terminating the process while the remote session is still active.

The current flow is:

SSH session established
        ↓
SSH communication occurs
        ↓
SSH session terminated
        ↓
BIOC Issue generated after approximately 1–5 minutes
        ↓
Playbook executed
        ↓
Process terminated

What I would like to achieve is:

SSH/RDP session established
        ↓
Communication detected in real time
        ↓
BIOC Issue generated
        ↓
Playbook executed
        ↓
Corresponding SSH/RDP process terminated

My question is:

Is there a way to configure a BIOC Rule so that an Issue Event is generated in real time while the SSH/RDP session is still active?

Currently, I am using event_type = ENUM.NETWORK for the detection. Is the delayed Issue generation after the session ends expected behavior for this type of network event?

Alternatively, is there another event type or field that I could use to detect the SSH/RDP session establishment or process initiation and trigger the Playbook while the session is still active?

Any guidance or recommendations would be greatly appreciated.

Thank you!

[susekar]

Hello @.522643 ,

Greetings for the day.

The delay is expected behavior based on the Cortex XDR EDR telemetry architecture. EDR data is collected locally, archived, and uploaded to the server in batches.

1. Explanation of the Delay:

The 1–5 minute delay occurs because:

• Archiving: EDR data is typically zipped every 5 minutes or when it reaches 20 MB.
• Heartbeat: Archived data is sent during the agent heartbeat, approximately every 5 minutes.
• Processing: The backend processes and stitches events before the Detection Engine triggers the BIOC Issue.
  
  

2. Achieving Real-Time Termination:

For real-time blocking or termination, use a Custom Prevention Rule instead of a server-side Playbook.

1. Go to Detection Rules → BIOC.
2. Use event_type = ENUM.PROCESS to block the SSH client from starting, or ENUM.NETWORK if supported.
3. Add the rule to a Restrictions Profile under Endpoints → Policy Management → Prevention → Profiles.
4. Set the action to Block or Terminate.
5. Apply the profile to the target endpoints.
   
   

Alternative Event Types

• ENUM.PROCESS: Best for blocking the SSH/RDP client at startup.
• ENUM.NETWORK: Can block based on destination port 22 when applied in Prevention Mode.
  
  

Summary:

• Playbooks are not real-time for EDR events and are subject to the ~5-minute upload delay.
• Prevention is the standard approach for real-time enforcement.
• Restriction Profiles provide real-time blocking, while Playbooks are mainly for post-detection remediation.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar