Test Custom BIOC Rules

[Muhammad-Rusli]

Hi Expert,

Please help me to create custom BIOC rules for the testing.

My company want to create rules bioc informational if We create/delete spesific file in spesific folder, and the information will appears in incidents.

Is it possible? 

If is it possible, please inform to me How to create that?

Thanks Expert, please give me advice

[bbarmanroy]

Hi @Muhammad-Rusli , you need to use event_sub_type (in your case, these should be FILE_CREATE and FILE_REMOVE). Please see a basic BIOC to get you started. You can tune it to your needs.

dataset = xdr_data 
| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_REMOVE) and action_file_path contains "D:\"

Link: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...