how to change BIOC analytics to prevention mode

[NCherbib]

hello, 

how is it possible to set bioc analytics alerts as prevent instead of detect.

BR;

[nikoolayy1]

You can try from the action center to make a new automation action if possible to autoisolate or scan the endpoint but BIOC is a protection after the attack has happened. Also you may need Palo Alto XSOAR to make a playbook to auto trigger when an alert/Incident with the BIOC is triggered as the default XDR automations could be limited. XSOAR has trial version and there is a nice free training for it:

https://www.youtube.com/watch?v=BhpkZA9t1HA&list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ

https://start.paloaltonetworks.com/sign-up-for-community-edition.html

You can also book a free workshop for the XSOAR:

https://www.paloaltonetworks.com/cortex/cortex-xsoar/virtual-hands-on-workshop

[nikoolayy1]

If you managed to get the needed answers, please flag the question as answered.