XDR BIOC Rules

[Shahwaz_Md]

Hi All,

We have a few Palo Alto BIOCs that are disabled in our console, does Palo alto disables those rules by themselves if yes where can we find more details about it like why it was disabled in the first place.

Regards,

Shahwaz

[nsinghvirk]

Hello @Shahwaz_Md 

Thanks for reaching out on LiveCommunity!

Yes, BIOC rules can get auto disable if they generate too many alerts. XDR's anti flooding mechanism disables the BIOC rule and also provide you reason under the "Disable Reason" field in the BIOC rule table. You can even hover your mouse on the status and a pop up will appear with details like who disabled the rule, when and why it was disabled.

More details-> https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit...

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[Shahwaz_Md]

Hi ,

I can't see anything when i hover over the disabled rule, i suspect this was disabled as a part of content update. Can you pls help me where i can check the content release notes.

Regards,

Shahwaz

[nsinghvirk]

Hello @Shahwaz_Md 

This feature has not been disabled. You need to move your mouse on the "Disabled" keyword. Are you able to see the "Disabled Reason" column?

To check the latest release notes, please click on the Username at the bottom left side and then click on "What's new in this Release". Here you can see the latest features and link to release notes.