timestamps for suppression rule (BIOC)

[S-LEGOUGE]

Hello everyone,

I need your help because I want to create a BIOC deletion rule, I have the hash, the username and the path but I would like this deletion to be effective during a specific time slot, can it be configured?

[neelrohit]

Hi @S-LEGOUGE ,

Thank you for writing to live community!

IOC/BIOC suppression rule cannot be schduled as they are global by nature and real time.

[S-LEGOUGE]

Hi @neelrohit 

Thank you very much for this precision, do you think it would be possible to avoid any alert resulting from a BIOC rule by using a correlation rule because I see that we can define a calendar?

Thanks in advance

[neelrohit · Accepted solution]

Hi @S-LEGOUGE ,

Avoiding a BIOC rule to get a hit and generate an alert can happen in 3 ways only: 

1. You disable the BIOC rule
2. You create rule exceptions(now known as IOC/BIOC suppression rules)
3. Disable the original BIOC rule, create a copy of it and fine tune it as per your own requirements

Correlation rule is another mechanism of creating alerting rules as per your choice on the basis of XQL queries and scheduling the XQL to run for a time frame in a particular period.

Hope this helps!

Please mark the answer "Accepted as Solution" if it does

Regards

[S-LEGOUGE]

Hello @Neelrohit ,

Thank you very much for this explanation and that answers my question.

Thank you again and my best wishes for 2023 😉

Regards,

Sebastien