XDR Usecase Creation | XDR Rule

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

XDR Usecase Creation | XDR Rule

L1 Bithead

We have 3 use cases for which we want to set up 3 rules in XDR, we would like to get your help to identify the best avenue to address them :

  • UC 1 : deploy a rule that DETECT a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
  • UC 2 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), AND generate an incident.
  • UC 3 : deploy a rule that PREVENT/BLOCK a behavior or IOC (ex: failed auth, file with specific SHA1...), WITHOUT generating an incident.

For each use case, please advise what feature to use (e.g.: BIOC, blocklist, correlation rule) and if a change in the profiles is required, as per your guides and best practices.

Cortex XDR  @LiveCommunityMemberOD @JayGolf 

1 accepted solution

Accepted Solutions

Sorry this is the correct link Custom Prevention Rules| Palo Alto Networks

If you found this answer helpful, please select Accept as Solution.

View solution in original post

3 REPLIES 3

L3 Networker

Hi Mohitparashar,

 

Adding an IOC is a Detect Only indicator. We recommend that IOCs be added to the firewall policy to block as URL filtering is a Layer 7 mechanism and Cortex operates on Layer 3. If you are using a Palo Alto firewall you may leverage the EDL (Manage External Dynamic Lists ) to block the domain and IP.

 

For non-network events, you may create a custom BIOC using an XQL query to enable a custom prevention rule then add it to the Restrictions Profile applied to the endpoints as outlined in this video Custom Prevention Rules| Palo Alto Networks

 

The following describes the event_type values for which you can create a BIOC rule.

  • FILE—Events relating to file create, write, read, and rename according to the file name and path.
  • INJECTION—Events related to process injections.
  • LOAD_IMAGE—Events relating to module IDs of processes.
  • NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.
  • PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.
  • REGISTRY—Events relating to registry write, rename and delete according to registry path.
  • STORY—Events relating to a combination of firewall and endpoint logs over the network.
  • EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.

Once created, you can add the BIOC to restrictions profiles. 

 

A few caveats...

 

Please note, XDR works on process instances termination and not network termination. For example, any network connection made using browsers for the URL (using a BIOC) will kill the browser itself and not just the network connection. As a result, all other browser tabs will also shut down. Therefore, adding a BIOC for domains/IPs is not a recommended action. It is recommended to set up a firewall configuration for URL filtering.

 

Reference 

Create a BIOC Rule • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation ...

Threat Hunting with XDR | Palo Alto Networks

 

If you found this answer helpful, please select Accept as Solution.

 

Thank you

If you found this answer helpful, please select Accept as Solution.

Hello @jtalton 

 

My access to the video resource is denied. 
https://live.paloaltonetworks.com/t5/shaolin-beta-articles/video-tutorial-custom-prevention-rules/ta...

 

Could you please help me with how to access and why it is getting denied?

Regards,

 

Mohit

Sorry this is the correct link Custom Prevention Rules| Palo Alto Networks

If you found this answer helpful, please select Accept as Solution.
  • 1 accepted solution
  • 1271 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!