Restrict traffic to public IP addresses with Cortex

[mike_dunlap]

I have dual homed systems with one of the IP addresses being publicly routable due to a cellular connection. My goal is to use Cortex to block traffic destined to those public IPs. An XQL query has been constructed to match traffic I would like to block, and I have created a BIOC that meets the intent as well, however I'm not seeing that BIOC as a custom prevention rule when I set up the restriction profile.

Does anyone have a suggestion on how to best handle this?

Thanks!

[eluis]

Hi @mike_dunlap 

Cortex XDR is not intended to be used as a Fw to block traffic. 

Im not sure what you are trying to do. I can tell you that once you have created a BIOC rule, depending on the type of BIOC you can add it to a restriction profile

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis