> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/bioc-commands.md).
# BIOC Commands
* [getBIOCRules](#getbiocrules)
* [createBIOCRule](#createbiocrule)
* [deleteBIOCRule](#deletebiocrule)
* [setBIOCRule](#setbiocrule)
#### getBIOCRules
***
Gets a list of BIOC rules. Filter arguments support both a single string and an array of strings.
Arguments
| Argument Name | Description | Required |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The id(s) of the bioc rule(s). | Optional |
| name | The name of the BIOC rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| type | The type of the BIOC rule. | Optional |
| is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional |
| comment | A comment for the BIOC rule. | Optional |
| status | The status of the BIOC rule. | Optional |
| indicator | The indicator pattern of the BIOC rule. | Optional |
| mitre\_technique\_id\_and\_name | The MITRE technique ID and name. | Optional |
| mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name. | Optional |
| filter\_json | A JSON string representing filter conditions. | Optional |
| extra\_data | Whether to include extra data in the response. Possible values are: true, false. | Optional |
| limit | The maximum number of results to return. | Optional |
| page\_size | The number of results per page. | Optional |
| page | The page number to retrieve. | Optional |
Outputs
**Core.BIOC.rule\_id** *number*
The unique identifier of the BIOC rule.
**Core.BIOC.name** *string*
The name of the BIOC rule.
**Core.BIOC.type** *string*
The type of the BIOC rule.
**Core.BIOC.severity** *string*
The severity of the BIOC rule.
**Core.BIOC.status** *string*
The status of the BIOC rule.
#### createBIOCRule
***
Creates a Behavioral Indicator of Compromise (BIOC) rule that triggers an issue when the specified behavior pattern is observed.
Arguments
| Argument Name | Description | Required |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| name | The name of the BIOC rule. | Required |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Required |
| type | The type of the BIOC rule. | Required |
| is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional |
| comment | A comment for the BIOC rule. | Optional |
| status | The status of the BIOC rule. | Optional |
| indicator | The indicator pattern of the BIOC rule. | Required |
| mitre\_technique\_id\_and\_name | The MITRE technique ID and name. | Optional |
| mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name. | Optional |
Outputs
**Core.BIOC.rule\_id** *string*
The ID of the created/set BIOC rule.
#### deleteBIOCRule
***
Deletes Behavioral Indicator of Compromise (BIOC) rules matching the specified filters. If multiple rules match, all of them are deleted.
Arguments
| Argument Name | Description | Required |
| ------------------------------- | ----------------------------------------------------------------- | -------- |
| rule\_id | The ID(s) of the BIOC rule(s) to delete. | Optional |
| name | The name of the BIOC rule to delete. | Optional |
| severity | The severity of the BIOC rule to delete. | Optional |
| type | The type of the BIOC rule to delete. | Optional |
| is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional |
| comment | A comment for the BIOC rule to delete. | Optional |
| status | The status of the BIOC rule to delete. | Optional |
| indicator | The indicator pattern of the BIOC rule to delete. | Optional |
| mitre\_technique\_id\_and\_name | The MITRE technique ID and name of the BIOC rule to delete. | Optional |
| mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name of the BIOC rule to delete. | Optional |
**Outputs**
There are no outputs for this command.
#### setBIOCRule
***
Sets an existing Behavioral Indicator of Compromise (BIOC) rule. Only the fields provided are changed.
Arguments
| Argument Name | Description | Required |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The ID of the BIOC rule to set. | Required |
| name | The name of the BIOC rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| type | The type of the BIOC rule. | Optional |
| is\_xql | Whether the BIOC rule uses XQL. Possible values are: true, false. | Optional |
| comment | A comment for the BIOC rule. | Optional |
| status | The status of the BIOC rule. | Optional |
| indicator | The indicator pattern of the BIOC rule. | Optional |
| mitre\_technique\_id\_and\_name | The MITRE technique ID and name. | Optional |
| mitre\_tactic\_id\_and\_name | The MITRE tactic ID and name. | Optional |
**Outputs**
There are no outputs for this command.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/bioc-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.