Suspicious domain suffix with a rare user agent - Explanation

[AvesterFahimipour]

Hello Community,

The BIOC Analytics has recently added these alerts and I wanted to get some insight and I hope this thread can be used in the future by others as well.

While the same seems straightforward there are some issues. The name of the alert suggests that a suspicious domain suffix was seen WITH a rare user agent.

The issue is that in the datasets the user agent field is NULL. So unless the originating process (chrome for example) is compromised it should not have a rare user agent. But I see that the domains reached out to are generally considered as normal.

[jmazzeo]

Hi @AvesterFahimipour, thanks for reaching us using the Live Community.

I can't find that BIOC Rules in my tenant, only "Suspicious domain suffix" and some about "abnormal" or "suspicious" user agent.

Were you able to check our Required data sources doc for the Analytics alerts? Maybe some data source is missing to fill the dataset fields.

If this post answers your question, please mark it as the solution.

[AvesterFahimipour]

You can see it under variations
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Suspi...

It does not mention anything about datasets and it is under XDR agent.

[AvesterFahimipour · Accepted solution]

Hello Everyone it seems that Cortex has removed the alerts for now until they fix it.