Detection rules

Learn how Cortex XSIAM detection rules identify threats using IOC, BIOC, and correlation logic.

Cortex XSIAM detection rules identify suspicious activity and generate issues for investigation.

Use IOC rules for known artifacts. Use BIOC rules for suspicious behavior. Use correlation rules to connect events across sources.

Explore detection rules

• What are detection rules?

• What's an IOC?

• What's a BIOC?

• What's a correlation rule?

• Manage IOC and BIOC rules

---