Create widget for bioc and ioc rule numbers

[ZuleyhaAy]

Hello everyone,

I am trying to get numbers of bioc and ioc rules from our xdr integration. I want to create a widget to see that how many ioc and bioc rules added week by week. Do anyone have idea for this?

Thanks in advance.

Cortex XDR Cortex XSOAR

[gyldz · Accepted solution]

Hi @ZuleyhaAy ,

Unfortunately, there is no OOTB command to get the rules. However, you can make use of xdr-get-audit-management-logs command. If you are heavily creating rules, please check the commands limitation for example for limit parameter, it says "

limit: Maximum number of audit logs to return per page. The default and maximum is 30." I am pasting here a sample script which could get the number of created BIOC rules and if you want to develop something else please use the below resources.

res = demisto.executeCommand("xdr-get-audit-management-logs", {"type": "Rules", "sub_type":"CREATE"})
count = 0
for rule in res[0]["Contents"]:
    if 'BIOC created' in rule['AUDIT_DESCRIPTION']:
        count += 1
demisto.results(count)

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Script-...

I hope this answers your question.