To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

The correct answer is D. event_type. BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR use XQL (Extended Query Language) to define suspicious behavioral patterns. For a BIOC rule to be syntactically and functionally valid, it must include at minimum a filter on the event_type field. This field specifies

Submitted by paula_co· Apr 18, 2026Detection and Alert Management

Question

Options

Acausality_chain
Bendpoint_name
Cthreat_event
Devent_type

How the community answered

(59 responses)

A
3% (2)
B
2% (1)
C
7% (4)
D
88% (52)

Explanation

BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR use XQL (Extended Query Language) to define suspicious behavioral patterns. For a BIOC rule to be syntactically and functionally valid, it must include at minimum a filter on the event_type field. This field specifies the category of telemetry event being examined (e.g., process, network, file, registry). Without filtering on event_type, the XDR engine cannot properly scope and evaluate the behavioral rule. Fields like causality_chain, endpoint_name, and threat_event are useful in queries but are not mandatory minimum requirements for a valid BIOC rule.

Topics

#BIOC Rules#XQL#Custom Detections#Rule Creation

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice