1. Home
    2. Security Operations
    3. Cortex XDR
    4. Cortex® XDR Pro Administrator’s Guide
    5. Investigation and Response
    6. Cortex XDR Rules
    7. Manage Existing Indicators

    Manage Existing Indicators

    From the Cortex XDR management console, you can edit, export, copy, disable, or remove rules, and add rule exceptions for existing indicators.
    After you create an indicator rule, you can take the following actions:
    For Analytics BIOC rules, you can only disable and enable rules.

    View Alerts Triggered by a Rule

    As your IOC and BIOC rules trigger alerts,
    Cortex
    XDR
     displays the total
    # OF HITS
     for the rule in the on the BIOC or IOC rules page. For rules with a high, medium, or low severity that have raised one or more alerts, you can quickly pivot to a filtered view of those alerts raised by the indicator:
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
       and the type of rule (
      BIOC
       or
      IOC
      ).
    2. Right-click anywhere in a rule, and then select
      View associated alerts
      .
      Cortex
      XDR
       displays a filtered query of alerts associated with the Rule ID.

    Use a BIOC Rule as the Basis of a Query

    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
       and the type of rule (
      BIOC
       or
      IOC
      ).
    2. Right-click anywhere in the rule, and then select
      Open in query builder
      .
      Cortex®
      XDR™
       populates a query using the criteria of the BIOC rule.
    3. If desired, add or change the query criteria.
    4. (
      Optional
      )
      Test
       your query to see the sample results.
    5. If you are satisfied with query,
      Save
       the query.
      For more information, see Manage Your Queries.

    Edit a Rule

    After you create a rule, it may be necessary to tweak or change the rule settings. You can open the rule configuration from the Rules page or from the pivot menu of an alert triggered by the rule. To edit the rule from the Rules page:
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
       and the type of rule (
      BIOC
       or
      IOC
      ).
    2. Locate the rule you want to edit.
    3. Right click anywhere in the rule and select
      Edit
      .
    4. Edit the rule settings as needed, and then click
      OK
      .
      If you make any changes,
      Test
       and then
      Save
       the rule.

    Export a Rule (BIOC Only)

    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
      BIOC
      .
    2. Select the rules that you want to export.
    3. Right click any of the rows, and select
      Export selected
      .
      The exported file is not editable, however you can use it as a source to import rules at a later date.

    Copy a BIOC Rule

    You can use an existing rule as a template to create a new one. Global BIOC rules cannot be deleted or altered, but you can copy a global rule and edit the copy. See Manage Global BIOC Rules.
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
       and then
      BIOC
      .
    2. Locate the rule you want to copy.
    3. Right click anywhere in the rule row and then select
      Save as New
       to create a duplicate rule.

    Disable or Remove a Rule

    If you no longer need a rule you can temporarily disable or permanently remove it.
    You cannot delete global BIOCs delivered with content updates.
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
       and the type of rule (
      BIOC
       or
      IOC
      ).
    2. Locate the rule that you want to change.
    3. Right click anywhere in the rule row and then select
      Remove
       to permanently delete the rule, or
      Disable
       to temporarily stop the rule. If you disable a rule you can later return to the rule page to
      Enable
       it.

    Add a Rule Exception

    If you want to create a rule to take action on specific behaviors but also want to exclude one or more indicators from the rule, you can create a rule exception. An indicator can include the SHA256 hash of a process, process name, process path, vendor name, user name, causality group owner (CGO) full path, or process command-line arguments. For more information about these indicators, see Rules. For each exception, you also specify the rule scope to which exception applies.
    Cortex
    XDR
     only supports exceptions with one attribute. See Add an Alert Exclusion Policy to create advanced exceptions based on your filtered criteria.
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
      Exceptions
      .
    2. Select
      + New Exception
      .
    3. Configure the indicators and conditions for which you want to set the exception.
    4. Choose the scope of the exception, whether the exception applies to IOCs, BIOCs, or both.
    5. Save
       the exception.
      By default, activity matching the indicators does not trigger any rule. As an alternative, you can select one or more rules. After you save the exception, the
      Exceptions
       count for the rule increments. If you later edit the rule, you will also see the exception defined in the rule summary.

    Export A Rule Exception

    You can choose to export a BIOC rule exception.
    1. From
      Cortex
      XDR
      , select
      Detection & Threat Intel
      Detection Rules
      Exceptions
      .
    2. In the
      Exceptions
       table, locate the exception rule you want to export. You can select multiple rules.
    3. Right-click and select
      Export
      .
      If one or more of the selected exceptions are applied to a specific BIOC rule, select one of the following options:
      • Export anyway
      • Export only non-specific Exceptions
        —Only export exceptions applied on all BIOC rules.
      • Export all Exceptions as non-specific
        —Export and apply specific Exceptions to BIOC rules.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo