> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/bioc-commands.md). # BIOC Commands * [getBIOCRules](#getbiocrules) * [createBIOCRule](#createbiocrule) * [deleteBIOCRule](#deletebiocrule) * [setBIOCRule](#setbiocrule) #### getBIOCRules *** Returns a list of BIOC rules based on the provided filter criteria.
Arguments | Argument Name | Description | Required | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | rule\_id | The ID of the BIOC rule to filter by. | Optional | | name | The name of the BIOC rule to filter by. Supports partial matching. | Optional | | indicator | The indicator text of the BIOC rule to filter by. Supports partial matching. | Optional | | severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional | | type | The category type of the BIOC rule. Possible values are: Collection, Credential Access, Discovery, Dropper, Evasion, Execution, Exfiltration, File Privilege Manipulation, File Type Obfuscation, Infiltration, Lateral Movement, Other, Persistence, Privilege Escalation, Reconnaissance, Tampering. | Optional | | status | The status of the BIOC rule. Possible values are: Enabled, Disabled, Detection Disabled, Prevention Disabled. | Optional | | is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional | | comment | The comment on the BIOC rule to filter by. Supports partial matching. | Optional | | status | The status of the BIOC rule. | Optional | | mitre\_technique\_id\_and\_name | The MITRE technique ID and name to filter by. Supports partial matching. | Optional | | mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name to filter by. Supports partial matching. | Optional | | filter\_json |

A JSON-encoded filter object to append additional filter conditions.

Example: \[{"field":"rule\_id","operator":"EQ","value":1}].

| Optional | | filter\_object |

A JSON-encoded webapp filter object. When provided, overrides all other filter arguments.

Example: {"AND":\[{"SEARCH\_FIELD":"RULE\_NAME","SEARCH\_TYPE":"CONTAINS","SEARCH\_VALUE":"test"}]}.

| | | extra\_data | Whether to include extra data in the response. Possible values are: true, false. | Optional | | limit | The maximum number of results to return. Ignored when 'page' or 'page\_size' is provided. Default is 50. | Optional | | page\_size | The number of results to return per page. When provided, manual pagination is used and 'limit' is ignored. | Optional | | page | The page number to retrieve (0-based). When provided, manual pagination is used and 'limit' is ignored. | Optional |
Outputs **Core.BIOC.rule\_id** *number* The unique identifier of the BIOC rule. **Core.BIOC.global\_rule\_id** *string* The global unique identifier of the BIOC rule. **Core.BIOC.name** *string* The name of the BIOC rule. **Core.BIOC.type** *string* The category type of the BIOC rule. **Core.BIOC.severity** *string* The severity of the BIOC rule. **Core.BIOC.status** *string* The status of the BIOC rule. **Core.BIOC.is\_xql** *boolean* Whether the BIOC rule uses XQL. **Core.BIOC.comment** *string* The comment on the BIOC rule. **Core.BIOC.source** *string* The source of the BIOC rule. **Core.BIOC.mitre\_tactic\_id\_and\_name** *string* The MITRE tactic ID and name. **Core.BIOC.mitre\_technique\_id\_and\_name** *string* The MITRE technique ID and name. **Core.BIOC.number\_of\_issues** *number* The number of times the rule has been triggered. **Core.BIOC.total\_exceptions** *number* The total number of exceptions for the rule. **Core.BIOC.creation\_time** *number* The insertion timestamp of the BIOC rule in milliseconds. **Core.BIOC.modification\_time** *number* The last modification timestamp of the BIOC rule in milliseconds. **Core.BIOC.status\_changed\_by** *string* The user who last changed the rule status. **Core.BIOC.status\_changed\_at** *number* The timestamp when the rule status was last changed in milliseconds. **Core.BIOC.is\_preventable** *boolean* Whether the BIOC rule supports prevention mode. **Core.BIOC.indicator\_text** *unknown* The indicator text of the BIOC rule. **Core.BIOC.indicator** *unknown* The raw indicator definition of the BIOC rule. **Core.BIOC.xql** *unknown* The XQL query of the BIOC rule, if applicable.
#### createBIOCRule *** Creates a Behavioral Indicator of Compromise (BIOC) rule that triggers an issue when the specified behavior pattern is observed.
Arguments | Argument Name | Description | Required | | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | name | The name of the BIOC rule. | Required | | severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Required | | type | The type of the BIOC rule. | Required | | is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional | | comment | A comment for the BIOC rule. | Optional | | status | The status of the BIOC rule. | Optional | | indicator | The indicator pattern of the BIOC rule. | Required | | mitre\_technique\_id\_and\_name | The MITRE technique ID and name. | Optional | | mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name. | Optional |
Outputs **Core.BIOC.rule\_id** *string* The ID of the created/set BIOC rule.
#### deleteBIOCRule *** Deletes Behavioral Indicator of Compromise (BIOC) rules matching the specified filters. If multiple rules match, all of them are deleted.
Arguments | Argument Name | Description | Required | | ------------------------------- | ----------------------------------------------------------------- | -------- | | rule\_id | The ID(s) of the BIOC rule(s) to delete. | Optional | | name | The name of the BIOC rule to delete. | Optional | | severity | The severity of the BIOC rule to delete. | Optional | | type | The type of the BIOC rule to delete. | Optional | | is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional | | comment | A comment for the BIOC rule to delete. | Optional | | status | The status of the BIOC rule to delete. | Optional | | indicator | The indicator pattern of the BIOC rule to delete. | Optional | | mitre\_technique\_id\_and\_name | The MITRE technique ID and name of the BIOC rule to delete. | Optional | | mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name of the BIOC rule to delete. | Optional |
**Outputs** There are no outputs for this command. #### setBIOCRule *** Sets an existing Behavioral Indicator of Compromise (BIOC) rule. Only the fields provided are changed.
Arguments | Argument Name | Description | Required | | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | rule\_id | The ID of the BIOC rule to set. | Required | | name | The name of the BIOC rule. | Optional | | severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional | | type | The type of the BIOC rule. | Optional | | is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional | | comment | A comment for the BIOC rule. | Optional | | status | The status of the BIOC rule. | Optional | | indicator | The indicator pattern of the BIOC rule. | Optional | | mitre\_technique\_id\_and\_name | The MITRE technique ID and name. | Optional | | mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name. | Optional |
**Outputs** There are no outputs for this command. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/bioc-commands.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.