BIOC Commands

• getBIOCRules
• createBIOCRule
• deleteBIOCRule
• setBIOCRule

getBIOCRules

---

Returns a list of BIOC rules based on the provided filter criteria.

Arguments

Argument Name	Description	Required
rule_id	The ID of the BIOC rule to filter by.	Optional
name	The name of the BIOC rule to filter by. Supports partial matching.	Optional
indicator	The indicator text of the BIOC rule to filter by. Supports partial matching.	Optional
severity	The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.	Optional
type	The category type of the BIOC rule. Possible values are: Collection, Credential Access, Discovery, Dropper, Evasion, Execution, Exfiltration, File Privilege Manipulation, File Type Obfuscation, Infiltration, Lateral Movement, Other, Persistence, Privilege Escalation, Reconnaissance, Tampering.	Optional
status	The status of the BIOC rule. Possible values are: Enabled, Disabled, Detection Disabled, Prevention Disabled.	Optional
is_xql	Whether the BIOC rule uses XQL. Possible values are: true, false.	Optional
comment	The comment on the BIOC rule to filter by. Supports partial matching.	Optional
status	The status of the BIOC rule.	Optional
mitre_technique_id_and_name	The MITRE technique ID and name to filter by. Supports partial matching.	Optional
mitre_tactic_id_and_name	The MITRE tactic ID and name to filter by. Supports partial matching.	Optional
filter_json	A JSON-encoded filter object to append additional filter conditions. Example: [{"field":"rule_id","operator":"EQ","value":1}].	Optional
filter_object	A JSON-encoded webapp filter object. When provided, overrides all other filter arguments. Example: {"AND":[{"SEARCH_FIELD":"RULE_NAME","SEARCH_TYPE":"CONTAINS","SEARCH_VALUE":"test"}]}.
extra_data	Whether to include extra data in the response. Possible values are: true, false.	Optional
limit	The maximum number of results to return. Ignored when 'page' or 'page_size' is provided. Default is 50.	Optional
page_size	The number of results to return per page. When provided, manual pagination is used and 'limit' is ignored.	Optional
page	The page number to retrieve (0-based). When provided, manual pagination is used and 'limit' is ignored.	Optional

Outputs

Core.BIOC.rule_id number

The unique identifier of the BIOC rule.

Core.BIOC.global_rule_id string

The global unique identifier of the BIOC rule.

Core.BIOC.name string

The name of the BIOC rule.

Core.BIOC.type string

The category type of the BIOC rule.

Core.BIOC.severity string

The severity of the BIOC rule.

Core.BIOC.status string

The status of the BIOC rule.

Core.BIOC.is_xql boolean

Whether the BIOC rule uses XQL.

Core.BIOC.comment string

The comment on the BIOC rule.

Core.BIOC.source string

The source of the BIOC rule.

Core.BIOC.mitre_tactic_id_and_name string

The MITRE tactic ID and name.

Core.BIOC.mitre_technique_id_and_name string

The MITRE technique ID and name.

Core.BIOC.number_of_issues number

The number of times the rule has been triggered.

Core.BIOC.total_exceptions number

The total number of exceptions for the rule.

Core.BIOC.creation_time number

The insertion timestamp of the BIOC rule in milliseconds.

Core.BIOC.modification_time number

The last modification timestamp of the BIOC rule in milliseconds.

Core.BIOC.status_changed_by string

The user who last changed the rule status.

Core.BIOC.status_changed_at number

The timestamp when the rule status was last changed in milliseconds.

Core.BIOC.is_preventable boolean

Whether the BIOC rule supports prevention mode.

Core.BIOC.indicator_text unknown

The indicator text of the BIOC rule.

Core.BIOC.indicator unknown

The raw indicator definition of the BIOC rule.

Core.BIOC.xql unknown

The XQL query of the BIOC rule, if applicable.

createBIOCRule

---

Creates a Behavioral Indicator of Compromise (BIOC) rule that triggers an issue when the specified behavior pattern is observed.

Arguments

Argument Name	Description	Required
name	The name of the BIOC rule.	Required
severity	The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.	Required
type	The type of the BIOC rule.	Required
is_xql	Whether the BIOC rule uses XQL. Possible values are: true, false.	Optional
comment	A comment for the BIOC rule.	Optional
status	The status of the BIOC rule.	Optional
indicator	The indicator pattern of the BIOC rule.	Required
mitre_technique_id_and_name	The MITRE technique ID and name.	Optional
mitre_tactic_id_and_name	The MITRE tactic ID and name.	Optional

Outputs

Core.BIOC.rule_id string

The ID of the created/set BIOC rule.

deleteBIOCRule

---

Deletes Behavioral Indicator of Compromise (BIOC) rules matching the specified filters. If multiple rules match, all of them are deleted.

Arguments

Argument Name	Description	Required
rule_id	The ID(s) of the BIOC rule(s) to delete.	Optional
name	The name of the BIOC rule to delete.	Optional
severity	The severity of the BIOC rule to delete.	Optional
type	The type of the BIOC rule to delete.	Optional
is_xql	Whether the BIOC rule uses XQL. Possible values are: true, false.	Optional
comment	A comment for the BIOC rule to delete.	Optional
status	The status of the BIOC rule to delete.	Optional
indicator	The indicator pattern of the BIOC rule to delete.	Optional
mitre_technique_id_and_name	The MITRE technique ID and name of the BIOC rule to delete.	Optional
mitre_tactic_id_and_name	The MITRE tactic ID and name of the BIOC rule to delete.	Optional

Outputs

There are no outputs for this command.

setBIOCRule

---

Sets an existing Behavioral Indicator of Compromise (BIOC) rule. Only the fields provided are changed.

Arguments

Argument Name	Description	Required
rule_id	The ID of the BIOC rule to set.	Required
name	The name of the BIOC rule.	Optional
severity	The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.	Optional
type	The type of the BIOC rule.	Optional
is_xql	Whether the BIOC rule uses XQL. Possible values are: true, false.	Optional
comment	A comment for the BIOC rule.	Optional
status	The status of the BIOC rule.	Optional
indicator	The indicator pattern of the BIOC rule.	Optional
mitre_technique_id_and_name	The MITRE technique ID and name.	Optional
mitre_tactic_id_and_name	The MITRE tactic ID and name.	Optional

Outputs

There are no outputs for this command.