This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About BenHooper
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About BenHooper
12-08-2020
9Posts
3Likes
0Solutions
Dec 08, 2020Last Visited
User
Activity
User
Profile
Latest posts by BenHooper
| Subject | Views | Posted |
|---|---|---|
| 2406 | 10-28-2020 04:35 AM | |
| 2619 | 09-25-2020 08:46 AM | |
| 1922 | 09-23-2020 02:53 AM | |
| 1638 | 09-22-2020 08:45 AM | |
| 1999 | 09-22-2020 08:21 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-28-2020 04:35 AM | |
| 2 Likes | 09-23-2020 02:53 AM |
User Badges
Community Statistics
| Member Since | 07-30-2020 04:24 AM |
| Date Last Visited | 12-08-2020 06:03 AM |
| Posts | 9 |
| Total Likes Received | 3 |
10-28-2020
04:35 AM
1 Kudo
While I'm awaiting a reply, just so others know, a side effect of modifying an existing BIOC rules is that a significant number of its alerts / incidents get re-created.
... View more
09-25-2020
08:46 AM
When it comes to excluding legitimate behaviours from BIOC rules, as far as I can see, there are 3 options: Modify the BIOC rule itself adding "not equal to" logic. Add BIOC rule exclusion at https://<organisation>.xdr.eu.paloaltonetworks.com/rules/exceptions Add incident / alert exclusion at https://<organisation>.xdr.eu.paloaltonetworks.com/exclusion What is the recommended way and differences between these methods? Thanks.
... View more
09-23-2020
02:53 AM
2 Kudos
It'd be very useful for things like failed logons or network connection attempts if BIOC rules could utilise timeframes. Is this on the roadmap? It could work well if this was done in a similar way to NGFW → OBJECTS → Custom Objects → Vulnerability → <object> → Signatures → Combination → Time Attribute:
... View more
09-22-2020
08:45 AM
The file event search is supposed to support reads but I've never seen it work. Is this a known problem? Examples:
... View more
09-22-2020
08:21 AM
After reading https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed → "MITRE Tags Enhancements", I retroactively added the appropriate MITRE ATT&CK technique numbers to my custom BIOC rules and noticed that the following are missing: T1564.005 "Hidden File System" T1564.006 "Run Virtual Instance"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-08-2020
06:03 AM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks