timestamps for suppression rule (BIOC)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

timestamps for suppression rule (BIOC)

L1 Bithead

Hello everyone,

 

I need your help because I want to create a BIOC deletion rule, I have the hash, the username and the path but I would like this deletion to be effective during a specific time slot, can it be configured?

 

SLEGOUGE_0-1672912865406.png

 

1 ACCEPTED SOLUTION

Accepted Solutions

Hi @S-LEGOUGE ,

 

Avoiding a BIOC rule to get a hit and generate an alert can happen in 3 ways only: 

  1. You disable the BIOC rule
  2. You create rule exceptions(now known as IOC/BIOC suppression rules)
  3. Disable the original BIOC rule, create a copy of it and fine tune it as per your own requirements

Correlation rule is another mechanism of creating alerting rules as per your choice on the basis of XQL queries and scheduling the XQL to run for a time frame in a particular period.

 

Hope this helps!

 

Please mark the answer "Accepted as Solution" if it does

 

Regards

View solution in original post

4 REPLIES 4

L4 Transporter

Hi @S-LEGOUGE ,

 

Thank you for writing to live community!

 

IOC/BIOC suppression rule cannot be schduled as they are global by nature and real time.

L1 Bithead

Hi @neelrohit 

Thank you very much for this precision, do you think it would be possible to avoid any alert resulting from a BIOC rule by using a correlation rule because I see that we can define a calendar?

Thanks in advance

SLEGOUGE_0-1672936162891.png

 

 

Hi @S-LEGOUGE ,

 

Avoiding a BIOC rule to get a hit and generate an alert can happen in 3 ways only: 

  1. You disable the BIOC rule
  2. You create rule exceptions(now known as IOC/BIOC suppression rules)
  3. Disable the original BIOC rule, create a copy of it and fine tune it as per your own requirements

Correlation rule is another mechanism of creating alerting rules as per your choice on the basis of XQL queries and scheduling the XQL to run for a time frame in a particular period.

 

Hope this helps!

 

Please mark the answer "Accepted as Solution" if it does

 

Regards

Hello @Neelrohit ,

 

Thank you very much for this explanation and that answers my question.

Thank you again and my best wishes for 2023 😉

 

Regards,

 

Sebastien

 

 

 

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!