Create a BIOC Rule - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product
Cortex XSIAM
Creation date
2024-07-16
Last date published
2024-12-12
Category
Administrator Guide
Abstract

You can configure rules for behavioral indicators of compromise (BIOCs) to raise an alert on an identified threat.

After identifying a threat and its characteristics, you can configure rules for behavioral indicators of compromise (BIOCs). After you create a BIOC rule, Cortex XSIAM searches for the first 10,000 matches in your Cortex XSIAM tenant and raises an alert if a match is detected. Going forward, the app alerts when a new match is detected.

Note

To ensure your BIOC rules raise alerts efficiently and do not overcrowd your Alerts table, Cortex XSIAM automatically disables BIOC rules that reach 5000 or more hits over a 24-hour period.

Create a Rule from Scratch

You can create a new BIOC rule in a similar way as you create a search with Query Builder or by building the rule query with XQL Search. In both methods, you use Cortex Query Language (XQL) to define the rule using XQL syntax. The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using the xdr_data and cloud_audit_log datasets and presets for these datasets.Query BuilderQuery BuilderXQL Search

Note

  • A cloud_audit_log dataset requires a Cortex XDR Pro per GB license.

  • Currently, you cannot create a BIOC rule on customized datasets and only the filter stage, alter stage, and functions without any aggregations are supported for XQL queries that define a BIOC.

  • For BIOC rules, the field values in XQL are evaluated as case insensitive (config case_sensitive = false).

The following is an example of creating a BIOC rule in XQL.

dataset = xdr_data 
| filter event_type = PROCESS and 
         event_sub_type = PROCESS_START and 
         action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" 

The following describes the event_type values for which you can create a BIOC rule.

  • FILE—Events relating to file create, write, read, and rename according to the file name and path.

  • INJECTION—Events related to process injections.

  • LOAD_IMAGE—Events relating to module IDs of processes.

  • NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.

  • PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.

  • REGISTRY—Events relating to registry write, rename and delete according to registry path.

  • STORY—Events relating to a combination of firewall and endpoint logs over the network.

  • EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.

To create a BIOC rule:

  1. From Cortex XSIAM , select Detection & Threat IntelDetection RulesBIOC.

  2. Select + Add BIOC.

  3. Configure your BIOC criteria using one of the following methods.

    • Build the rule query with XQL Search.XQL Search

      1. Click XQL Search.

      2. The XQL query field is where you define the parameters of your query for the BIOC rule. To help you create an effective XQL query, the search field provides suggestions as you type. The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using the xdr_data and cloud_audit_log datasets and presets for these datasets. Currently, you cannot create a BIOC rule on customized datasets and only the filter stage, alter stage, and functions without any aggregations are supported for XQL queries that define a BIOC. For BIOC rules, the field values in XQL are evaluated as case insensitive (config case_sensitive = false). After configuring the XQL query for your BIOC rule and the syntax is valid, a valid-bioc.png indication is displayed, and it is possible to add the BIOC rule.

      3. Click Test BIOC. Rules that you do not refine enough can create thousands of alerts. As a result, it is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. For example, if a rule will return thousands of hits because you negated a single parameter, it is a good idea to test the rule before you save it and make it active.

        When you test the rule, Cortex XSIAM immediately searches for rule matches across all your Cortex XSIAM tenant data. If there are surprises, now is the time to see them and adjust the rule definition. The results are displayed in the Query Results tab underneath the XQL query field.

        Note

        For the purpose of showing you the expected behavior of the rule before you save it, Cortex XSIAM tests the BIOC on historical logs. After you save a BIOC rule, it will operate on both historical logs (up to 10,000 hits) and new data received from your log sensors.

      4. (Optional) Use the Schema tab to view schema information for every field found in the result set. This information includes the field name, data type, descriptive text (if available), and the dataset that contains the field. In order for a field to appear in the Schema tab, it must contain a non-NULL value at least once in the result set.

      5. Add as BIOC the new query rule configured.

    • Build the BIOC rule query through a specific entity in a similar way that you create a search with Query Builder.Query BuilderQuery Builder

      1. Select a particular entity icon. Define any relevant activity or characteristics for the entity type. Create a new BIOC rule in the same way that you create a search with the Query Builder. You use XQL to define the rule. The XQL query must filter on an event_type in order for it to be a valid BIOC rule.

      2. Test your BIOC rule. Rules that you do not refine enough can create thousands of alerts. As a result, it is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. For example, if a rule will return thousands of hits because you negated a single parameter, it is a good idea to test the rule before you save it and make it active.

        When you test the rule, Cortex XSIAM immediately searches for rule matches across all your Cortex XSIAM tenant data. If there are surprises, now is the time to see them and adjust the rule definition.

        Note

        For the purpose of showing you the expected behavior of the rule before you save it, Cortex XSIAM tests the BIOC on historical logs. After you save a BIOC rule, it will operate on both historical logs (up to 10,000 hits) and new data received from your log sensors.

      3. Save your BIOC rule.

  4. Define the following parameters.

    1. Name—Specify a descriptive Name to identify the BIOC rule or leave the default name that is automatically populated using the format XQL-BIOC-<rule number>.

    2. Type—Select a rule TYPE that describes the activity.

    3. Severity—Specify the Severity you want to associate with an alert generated based on this rule.

    4. (Optional) Select the MITRE Technique and MITRE Tactic you want to associate with the alert. You can select up to 3 MITRE Techniques/Sub-Techniques and MITRE Tactics.

    5. (Optional) Select the +<number> more global exceptions to view the EXCEPTIONS associated with this BIOC rule.

    6. (Optional) Comment—Specify any additional comments, such as why you created the BIOC.

    7. Click OK.

Configure a Custom Prevention Rule

Custom prevention rules are supported on Cortex XSIAM agent 7.2 and later versions and enable you to configure and apply user-defined BIOC rules to Restriction profiles deployed on your Windows, Mac, and Linux endpoints.

By using the BIOC rules, you can configure custom prevention rules to terminate the causality chain of a malicious process according to the Action Mode defined in the associated Restrictions Secuirty Profile and trigger Cortex XSIAM Agent behavioral prevention type alerts in addition to the BIOC rule detection alerts.

For example, if you configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block, the Cortex XSIAM agent:

  • Blocks a process at the endpoint level according to the defined rule properties.

  • Raises a behavioral prevention alert you can monitor and investigate in the Alerts table.

Before you configure a BIOC rule as a custom prevention rule, create a Restriction Profile for each type of operating system (OS) that you want to deploy your prevention rules.

To configure a BIOC rule as a prevention rule.

  1. In the BIOC Rule table, from the Source field, filter and locate a user-defined rule you want to apply as a custom prevention rule. You can only apply a BIOC rule that you created either from Create a Rule from Scratch or a Cortex XSIAM Global Rule template that meets the following criteria.

    • The user-defined BIOC rule does not include the following field configurations.

      • All Events—Host Name

      • File Event—Device Type, Device Serial Number

      • Process Event—Device Type, Device Serial Number

      • Network Event—Country, Raw Packet

    • BIOC rules with OS scope definitions must align with the Restrictions profile OS.

    • When defining the Process criteria for a user-defined BIOC rule event type, you can select to run only on actor, causality, and OS actor on Windows, and causality and OS actor on Linux and Mac.

  2. Test your BIOC rule.

    Rules that you do not refine enough can create thousands of alerts. As a result, it is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. Cortex XSIAM automatically disables BIOC rules that reach 5000 or more hits over a 24-hour period.

  3. Right-click and select Add to restrictions profile.

    If the rule is already referenced by one or more profiles, select See profiles to view the profile names.

  4. In the Add to Restrictions Profile pop-up:

    • Ensure the rule you selected is compatible with the type of endpoint operating system.

    • Select the Restriction Profile name you want to apply the BIOC rule to for each of the operating systems. BIOC event rules of type Event Log and Registry are only supported by Windows OS.

      Note

      You can only add to existing profiles you created, Cortex XSIAM Default profiles will not appear as an option.

  5. Add the BIOC rule to the selected profiles.

    The BIOC rule is now configured as a custom prevention rule and applied to your Restriction profiles. After the Restriction profile is pushed to your endpoints, the custom prevention rule can start triggering behavioral prevention-type alerts.

  6. Review and edit your custom prevention rules.

    1. Navigate to EndpointsPolicy ManagementProfiles.

    2. Locate the Restrictions Profile to which you applied the BIOC rule. In the Summary field, Custom Prevention Rules appears as Enabled.

    3. Right-click and select Edit.

    4. In the Custom Prevention Rules section, you can review and modify the following:

      • Action Mode—Select to Enable or Disable the BIOC prevention rules.

      • Auto-disable—Select if to auto-disable a BIOC prevention rule if it triggers after a defined number of times during a defined duration.

        Note

        Auto-disable will turn off both the BIOC rule detection and the BIOC prevention rule.

      • Prevention BIOC Rules table—Filter and maintain the BIOC rules applied to this specific Restriction Profile. Right-click to Delete a rule or Go to BIOC Rules table.

    5. Save your changes if necessary.

    6. Investigate the BIOC prevention rules alerts.

      • Select Incident ResponseIncidentsAlerts Table.

      • Filter the fields as follows:

        • Alert Source: XDR Agent

        • Action: Prevention (<profile action mode>)

        • Alert Name: Behavioral Threat

      • In the Description field, you can see the rule name that raised the prevention alert.

Import Rules

You can use the import feature of Cortex XSIAM to import BIOCs from external feeds or that you previously exported. The export/import capability is useful for rapid copying of BIOCs across different Cortex XSIAM instances.

Note

You can only import files that were exported from Cortex XSIAM. You can not edit an exported file.

  1. From Cortex XSIAM, select Detection & Threat IntelDetection RulesBIOC.

  2. Select Import Rules.

  3. Drag and drop the file on the import rules dialog or browse to a file.

  4. Click Import.

    Cortex XSIAM loads any BIOC rules. This process may take a few minutes depending on the size of the file.

  5. Refresh the BIOC Rules page to view matches (# of Hits) in your historical data.

  6. To investigate any matches, view the Alerts page and filter the Alert Name by the name of the BIOC rule.