You can configure rules for behavioral indicators of compromise (BIOCs) to trigger an alert on an identified threat.
When you identify a threat and its characteristics, you can configure rules for behavioral indicators of compromise (BIOCs) for this threat. After you create a BIOC rule, Cortex XSIAM searches for the first 10,000 matches in your tenant and triggers an alert if a match is detected. After the initial scan, Cortex XSIAM triggers alerts every time a new match is detected.
You can create a BIOC either by configuring a single one or by uploading a file that contains multiple BIOCs.
Note
To ensure your BIOC rules trigger alerts efficiently and do not overcrowd your Alerts table, Cortex XSIAM automatically disables BIOC rules that reach 5000 or more hits over a 24-hour period.
You can create a new BIOC rule in a similar way as you create a search with Query Builder or by building the rule query with XQL Search. In both methods, you use Cortex Query Language (XQL) to define the rule using XQL syntax. The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using the xdr_data and cloud_audit_log datasets and presets for these datasets.
Note
A
cloud_audit_logdataset requires a Cortex XDR Pro per GB license.Currently, you cannot create a BIOC rule on customized datasets and only the
filterstage,alterstage, and functions without any aggregations are supported for XQL queries that define a BIOC.For BIOC rules, the field values in XQL are evaluated as case insensitive (
config case_sensitive = false).
The following is an example of creating a BIOC rule in XQL.
dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" The following describes the event_type values for which you can create a BIOC rule.
FILE—Events relating to file create, write, read, and rename according to the file name and path.INJECTION—Events related to process injections.LOAD_IMAGE—Events relating to module IDs of processes.NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.REGISTRY—Events relating to registry write, rename and delete according to registry path.STORY—Events relating to a combination of firewall and endpoint logs over the network.EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.
To create a BIOC rule:
From Cortex XSIAM , select → .
Select + Add BIOC.
Configure your BIOC criteria using one of the following methods.
Click XQL Search.
The XQL query field is where you define the parameters of your query for the BIOC rule. To help you create an effective XQL query, the search field provides suggestions as you type. The XQL query must at a minimum filter on the
event_typefield in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using thexdr_dataandcloud_audit_logdatasets and presets for these datasets. Currently, you cannot create a BIOC rule on customized datasets and only thefilterstage,alterstage, and functions without any aggregations are supported for XQL queries that define a BIOC. For BIOC rules, the field values in XQL are evaluated as case insensitive (config case_sensitive = false). After configuring the XQL query for your BIOC rule and the syntax is valid, a
indication is displayed, and it is possible to add the BIOC rule.Click Test BIOC. Rules that you do not refine enough can create thousands of alerts. It is highly recommended that you test the behavior of a new or edited BIOC rule before you save it.
When you test the rule, Cortex XSIAM immediately searches for rule matches across all your Cortex XSIAM tenant data. The results are displayed in the Query Results tab underneath the XQL query field. Adjust any rule definition as needed.
Note
To demonstrate the expected behavior of the rule before you save it, Cortex XSIAM tests the BIOC on historical logs. After you save a BIOC rule, it will operate on both historical logs (up to 10,000 hits) and new data received from your log sensors.
(Optional) Use the Schema tab to view schema information for every field found in the result set. This information includes the field name, data type, descriptive text (if available), and the dataset that contains the field. In order for a field to appear in the Schema tab, it must contain a non-NULL value at least once in the result set.
Add as BIOC the new query rule configured.
Define the following parameters.
Name—Specify a description or leave the default name which is automatically populated using the format XQL-BIOC-<rule number>.
Type—Select a rule TYPE that describes the activity.
Severity—Specify the Severity you want to associate with an alert generated based on this rule.
(Optional) Select the MITRE Technique and MITRE Tactic you want to associate with the alert. You can select up to 3 MITRE Techniques/Sub-Techniques and MITRE Tactics.
(Optional) Select the +<number> more global exceptions to view the EXCEPTIONS associated with this BIOC rule.
(Optional) Comment—Specify any additional comments, such as why you created the BIOC.
Click OK.