XDR Analytics BIOC Alert exclusion

[RFeyertag]

Hello dear community members!

how would you exclude this? It is only popping up in one of our houses/domains. 

Maybe this way?

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bioc-analytics-specific-exceptions-and-v...

BR

Rob

[timurphy]

Hi @RFeyertag ,

Yes, you could take a similar approach as the link in your post to create an exclusion for these alerts. 

If you wanted to only exclude these types of alerts for specific processes or domains, you could do the following:

1. Navigate to Detection Rules>BIOC>Analytics BIOC Rules
2. Edit your layout so that “Global Rule ID” is one of the columns that is displayed in your view
3. Copy the Rule ID for the BIOC rule you wish to create an exclusion for, in this case - “Recurring rare domain access from an unsigned process”
4. Navigate to Incident Response>Incident Configuration>Alert Exclusions and click “Add Alert Exclusions”
5. In your filter, select the “Rule ID” field, select the “=“ operator, and paste the Rule ID value you copied in step 3 as the value. Click “+AND” to add another expression to your filter and choose either the “Initiated By” field (to exclude by process name) or the “Remote Host” field (to exclude by destination domain), select the “=“ operator, and set the value equal to the name of the process or domain generating the alerts you would like to exclude.
6. Enter a Policy Name/Comment and click "Create" to finish creating the Alert Exclusion.

Regards,

Tim