XDR Usecase Creation | XDR Rule

Mohitparashar · ‎12-01-2023

We have 3 use cases for which we want to set up 3 rules in XDR, we would like to get your help to identify the best avenue to address them :

UC 1 : deploy a rule that DETECT a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
UC 2 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
UC 3 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), WITHOUT generating an incident.

For each use case, please advise what feature to use (e.g.: BIOC, blocklist, correlation rule) and if a change in the profiles is required, as per your guides and best practices.

Cortex XDR @LiveCommunityMemberOD @JayGolf

jtalton · ‎12-05-2023

Sorry this is the correct link Custom Prevention Rules| Palo Alto Networks

If you found this answer helpful, please select Accept as Solution.

View solution in original post

jtalton · ‎12-05-2023

Hi Mohitparashar,

Adding an IOC is a Detect Only indicator. We recommend that IOCs be added to the firewall policy to block as URL filtering is a Layer 7 mechanism and Cortex operates on Layer 3. If you are using a Palo Alto firewall you may leverage the EDL (Manage External Dynamic Lists ) to block the domain and IP.

For non-network events, you may create a custom BIOC using an XQL query to enable a custom prevention rule then add it to the Restrictions Profile applied to the endpoints as outlined in this video Custom Prevention Rules| Palo Alto Networks

The following describes the event_type values for which you can create a BIOC rule.

FILE—Events relating to file create, write, read, and rename according to the file name and path.
INJECTION—Events related to process injections.
LOAD_IMAGE—Events relating to module IDs of processes.
NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.
PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.
REGISTRY—Events relating to registry write, rename and delete according to registry path.
STORY—Events relating to a combination of firewall and endpoint logs over the network.
EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.

Once created, you can add the BIOC to restrictions profiles.

A few caveats...

Please note, XDR works on process instances termination and not network termination. For example, any network connection made using browsers for the URL (using a BIOC) will kill the browser itself and not just the network connection. As a result, all other browser tabs will also shut down. Therefore, adding a BIOC for domains/IPs is not a recommended action. It is recommended to set up a firewall configuration for URL filtering.

Reference

Create a BIOC Rule • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation ...

Threat Hunting with XDR | Palo Alto Networks

If you found this answer helpful, please select Accept as Solution.

Thank you

If you found this answer helpful, please select Accept as Solution.