cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

BIOC not supported

L1 Bithead

Good afternoon,

 

I'm trying to create a BIOC rule that tells me when users are trying to access the wetransfer.com and dropbox.com DNS. To do this, I generated the following XQL. When run, it shows me the logs of the connections to these DNS.

 

dataset = xdr_data
| filter dns_query_name = "*wetransfer*" or dns_query_name = "*dropbox*"

 

This XQL works correctly, but when I write it in the BIOC rule, it gives me errors. First, it tells me I should include an Event_type. I modified the XQL and it looks like this:

 

dataset = xdr_data
| filter event_type = "STORY"
| filter dns_query_name = "*wetransfer*" or dns_query_name = "*dropbox*"

 

But when I run it, it tells me that BIOC is not supported.

Could you help me correct this XQL so that it works as a BIOC rule?

 

thanks

Who rated this post