> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/create-a-bioc-rule.md). # Create a BIOC rule {% hint style="info" %} ### Note Adding BIOC rules requires a Cortex XDR Pro license. {% endhint %} When you identify a threat and its characteristics, you can configure rules for behavioral indicators of compromise (BIOCs) for this threat. You can create a BIOC rule either by configuring a single one or by uploading a file that contains multiple BIOCs. After you create a BIOC rule, Cortex XDR searches for the first 10,000 matches in your tenant and generates an issue if a match is detected. After the initial scan, Cortex XDR generates issues every time a new match is detected. You can also use BIOC rules to create prevention rules that terminate the causality chain of a malicious process and generate Cortex XDR Agent behavioral prevention type issues. {% hint style="info" %} ### Note To ensure your BIOC rules generate issues efficiently and do not overcrowd your Issues table, Cortex XDR automatically does the following: * Disables BIOC rules that reach 5000 or more hits over a 24-hour period. * Creates a rule exception based on the PROCESS SHA256 field for BIOC rules that hit more than 100 endpoints over a 72 hour period. {% endhint %}
Create a BIOC rule from scratch You can create a new BIOC rule in a similar way as you create a search with Query Builder or by building the rule query with [XQL Search](https://docs-cortex.paloaltonetworks.com/r/GD6sG6FlxDWxAn13_eZuUQ/iXPPDQ2o7uMiETLeaL9yvQ). In both methods, use Cortex Query Language (XQL) to define the rule using XQL syntax. The XQL query must at a minimum filter on the `event_type` field in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using the `xdr_data` and `cloud_audit_log` datasets and presets for these datasets. {% hint style="info" %} ### Note * A `cloud_audit_log` dataset requires a **Cortex XDR Pro per GB** license. * Currently, you cannot create a BIOC rule on customized datasets and only the `filter` stage, `alter` stage, and functions without any aggregations are supported for XQL queries that define a BIOC. * For BIOC rules, the field values in XQL are evaluated as case insensitive (`config case_sensitive = false`). {% endhint %} The following is an example of creating a BIOC rule in XQL. ``` dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"  ``` The following describes the `event_type` values for which you can create a BIOC rule. * `FILE`—Events relating to file create, write, read, and rename according to the file name and path. * `INJECTION`—Events related to process injections. * `LOAD_IMAGE`—Events relating to module IDs of processes. * `NETWORK`—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol. * `PROCESS`—Events relating to execution and injection of a process name, hash, path, and CMD. * `REGISTRY`—Events relating to registry write, rename and delete according to registry path. * `STORY`—Events relating to a combination of firewall and endpoint logs over the network. * `EVENT_LOG`—Events relating to Windows event logs and Linux system authentication logs. To create a BIOC rule: 1. Select **Threat Management** → **Detection Rules** → **BIOC**. 2. Select **+ Add BIOC**. 3. Configure your BIOC criteria using one of the following methods. **Build the BIOC rule query with XQL Search.** 1. Click **XQL Search**. 2. The XQL query field is where you define the parameters of your query for the BIOC rule. To help you create an effective XQL query, the search field provides suggestions as you type. The XQL query must at a minimum filter on the `event_type` field in order for it to be a valid BIOC rule. In addition, you can create BIOC rules using the `xdr_data` and `cloud_audit_log` datasets and presets for these datasets. Currently, you cannot create a BIOC rule on customized datasets and only the `filter` stage, `alter` stage, and functions without any aggregations are supported for XQL queries that define a BIOC. For BIOC rules, the field values in XQL are evaluated as case insensitive (`config case_sensitive = false`). After configuring the XQL query for your BIOC rule and the syntax is valid, a indication is displayed, and it is possible to add the BIOC rule. 3. Click **Test BIOC**. Rules that you do not refine enough can generate thousands of issues. It is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. When you test the rule, Cortex XDR immediately searches for rule matches across all your Cortex XDR tenant data. The results are displayed in the **Query Results** tab underneath the XQL query field. Adjust any rule definition as needed.

Note

To demonstrate the expected behavior of the rule before you save it, Cortex XDR tests the BIOC on historical logs. After you save a BIOC rule, it will operate both on historical logs (up to 10,000 hits) and on new data received from your log sensors.

4. (Optional) Use the **Schema** tab to view schema information for every field found in the result set. This information includes the field name, data type, descriptive text (if available), and the dataset that contains the field. In order for a field to appear in the **Schema** tab, it must contain a non-NULL value at least once in the result set. 5. **Add as BIOC** the new query rule configured. **Build the BIOC rule query through a specific entity.** 1. Select an entity icon. Define any relevant activity or characteristics for the entity type. Create a new BIOC rule in the same way that you create a search with the Query Builder. You use XQL to define the rule. The XQL query must filter on an `event_type` in order for it to be a valid BIOC rule. 2. **Test** your BIOC rule. Rules that you do not refine enough can generate thousands of issues. It is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. When you test the rule, Cortex XDR immediately searches for rule matches across all your Cortex XDR Cortex XDR tenant data. Adjust any rule definition as needed.

Note

To demonstrate the expected behavior of the rule before you save it, Cortex XDR tests the BIOC on historical logs. After you save a BIOC rule, it will operate on both historical logs (up to 10,000 hits) and new data received from your log sensors.

3. **Save** the BIOC rule. 4. Define the following parameters. 1. **Name**—Specify a description or leave the default name which is automatically populated using the format **XQL-BIOC-\**. 2. **Type**—Select a rule **TYPE** that describes the activity. 3. **Severity**—Specify the **Severity** you want to associate with an issue generated based on this rule. 4. (Optional) Select the **MITRE Technique** and **MITRE Tactic** you want to associate with the issue. You can select up to 3 MITRE Techniques/Sub-Techniques and MITRE Tactics. 5. (Optional) Select the **+ more global exceptions** to view the **EXCEPTIONS** associated with this BIOC rule. 6. (Optional) **Comment**—Specify any additional comments, such as why you created the BIOC. 7. Click **OK**.
Import multiple BIOC rules To match multiple indicators, you can upload the criteria in a CSV file. You can upload BIOCs using REST APIs in either CSV or JSON format. Your file can be a list of BIOCs from external feeds or a file that you previously exported from Cortex XDR. The export/import capability is useful for rapid copying of BIOCs across different Cortex XDR instances. Upload a file, one BIOC per line, that contains up to 20,000 BIOCs. For example, you can upload multiple file paths and MD5 hashes for a BIOC rule. To help you format the upload file in the syntax that Cortex XDR accepts, you can download the example file. {% hint style="info" %} ### Note You can only import files that were exported from Cortex XDR. You can not edit an exported file. {% endhint %} 1. Select **Threat Management** → **Detection Rules** → **BIOC**. 2. Select **Import Rules**. 3. Drag and drop the file on the import rules dialog or **browse** to a file. 4. Click **Import**. Cortex XDR loads any BIOC rules. This process may take a few minutes depending on the size of the file. 5. Refresh the BIOC Rules page to view matches (# of Hits) in your historical data. 6. To investigate any matches, view the **Issues** page and filter the **Issue Name** by the name of the BIOC rule.
Configure a custom prevention rule {% hint style="info" %} ### Note Custom prevention rules are supported on Cortex XDR agent 7.2 and later versions and enable you to configure and apply user-defined BIOC rules to Restriction profiles deployed on your Windows, Mac, and Linux endpoints. {% endhint %} By using the BIOC rules, you can configure custom prevention rules to terminate the causality chain of a malicious process according to the Action Mode defined in the associated Restrictions Security Profile and generate Cortex XDR Agent behavioral prevention type issues in addition to the BIOC rule detection issues. For example, if you configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block, the Cortex XDR agent: * Blocks a process at the endpoint level according to the defined rule properties. * Generates a behavioral prevention issue that you can monitor and investigate in the **Issues** table. Before you configure a BIOC rule as a custom prevention rule, create a Restriction Profile for each type of operating system (OS) that you want to deploy your prevention rules. Note the following requirements and restrictions for converting a BIOC rule into a custom prevention rule: **Supported investigation types** To be eligible for conversion into a custom prevention rule, a BIOC rule must be based on one of the following investigation types: * file\_event * process\_execution * remote\_code\_execution * network\_event * registry\_event * windows\_event\_log * module\_event Available subtypes: * file\_event * network\_event * registry\_event * windows\_event\_log **Query structure requirements** The structure of your XQL query is critical for custom prevention rule compatibility. Adhere to the following guidelines: * Avoid using the `alter` stage. * Select PANW as the vendor. * If you use action\_module\_signature\_vendor, the investigation type must be module\_event. * The `NOT IN` operator is not supported for custom prevention rule conversion. If you need to exclude certain values, structure your query to use positive matching, for example include `IN` with `AND` conditions, or use a regular expression that excludes the desired values. **Supported fields** The following table lists all fields supported for custom prevention rule conversion and specifies their OS compatibility.
XQL FieldSupported Operating System
os_actor_process_image_pathWindows, macOS, Linux
os_actor_process_command_lineWindows, macOS, Linux
os_actor_process_image_md5Windows, macOS, Linux
os_actor_process_image_sha256Windows, macOS, Linux
os_actor_process_os_pidWindows, macOS, Linux
action_evtlog_descriptionWindows
action_evtlog_messageWindows
action_evtlog_provider_nameWindows
action_evtlog_usernameWindows
action_registry_key_nameWindows
action_registry_value_nameWindows
action_registry_dataWindows
action_module_pathWindows
action_module_md5Windows
action_module_sha256Windows
action_module_signature_vendorWindows
actor_process_signature_vendorWindows
causality_actor_process_signature_vendorWindows
os_actor_process_signature_vendorWindows
actor_process_signature_statusWindows
causality_actor_process_signature_statusWindows
os_actor_process_signature_statusWindows
action_remote_process_image_nameWindows
action_remote_process_image_pathWindows
action_remote_process_image_command_lineWindows
action_remote_process_os_pidWindows
To configure a BIOC rule as a prevention rule: 1. In **Threat Management → Detection Rules → BIOC**, from the **BIOC Rule** table, filter the **Source** field to locate a user-defined rule you want to apply as a custom prevention rule. You can only apply a BIOC rule that you created either from scratch or a Cortex XDR global rule template that meets the following criteria. * The user-defined BIOC rule does not include the following field configurations. * All Events—Host Name * File Event—Device Type, Device Serial Number * Process Event—Device Type, Device Serial Number * Network Event—Country, Raw Packet * BIOC rules with OS scope definitions must align with the Restrictions profile OS. * When defining the Process criteria for a user-defined BIOC rule event type, you can select to run only on actor, causality, and OS actor on Windows, and causality and OS actor on Linux and Mac. 2. **Test** your BIOC rule. Rules that you do not refine enough can generate thousands of issues. As a result, it is highly recommended that you test the behavior of a new or edited BIOC rule before you save it. Cortex XDR automatically disables BIOC rules that reach 5000 or more hits over a 24-hour period. 3. Right-click and select **Add to restrictions profile**. If the rule is already referenced by one or more profiles, select **See profiles** to view the profile names. 4. In the **Add to Restrictions Profile** pop-up: * Ensure the rule you selected is compatible with the type of endpoint operating system. * Select the Restriction Profile name you want to apply the BIOC rule to for each of the operating systems. BIOC event rules of type Event Log and Registry are only supported by Windows OS.

Note

5. **Add** the BIOC rule to the selected profiles. The BIOC rule is now configured as a custom prevention rule and applied to your Restriction profiles. After the Restriction profile is pushed to your endpoints, the custom prevention rule can start generating behavioral prevention-type issues. 6. Review and edit your custom prevention rules. 1. Navigate to **Endpoints → Policy Management → Profiles**. 2. Locate the Restrictions Profile to which you applied the BIOC rule. In the **Summary** field, **Custom Prevention Rules** appears as **Enabled**. 3. Right-click and select **Edit**. 4. In the **Custom Prevention Rules** section, you can review and modify the following: * **Action Mode**—Select to **Enable** or **Disable** the BIOC prevention rules. * **Auto-disable**—Select if to auto-disable a BIOC prevention rule if it triggers after a defined number of times during a defined duration.

Note

Auto-disable will turn off both the BIOC rule detection and the BIOC prevention rule.

* **Prevention BIOC Rules table**—**Filter** and maintain the BIOC rules applied to this specific Restriction Profile. Right-click to **Delete** a rule or **Go to BIOC Rules** table. 5. **Save** your changes if necessary. 6. Investigate the BIOC prevention rules issues. * Select **Cases & Issues → Issues**. * Filter the fields as follows: * **Issue Source**: **`XDR Agent`** * **Action**: **`Prevention (`*****``*****`)`** * **Issue Name**: **`Behavioral Threat`** * In the **Description** field, you can see the rule name that generated the prevention issue.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/create-a-bioc-rule.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.