View generating BIOC or IOC rule

You can view the BIOC or IOC rules that generated alerts directly from the Alerts table.

Notice

This functionality requires a Cortex XDR Pro license.

You can easily view and edit the BIOC and IOC rules that generated alerts directly from the Alerts table:

1. From the Alerts page, locate alerts with Alert Sources: XDR BIOC and XDR IOC.
2. Right-click the row, and select Manage Alert → View generating rule.

   Cortex XDR opens the BIOC rule that generated the alert in the BIOC Rules page. If the rule has been deleted, an empty table is displayed.
3. Review the rule, if necessary, right-click to perform available actions.