Which type of BIOC rule is currently available in Cortex XDR?

The correct answer is B. Discovery. The type of BIOC rule that is currently available in Cortex XDR is Discovery. A Discovery BIOC rule is a rule that detects suspicious or malicious behavior on endpoints based on the Cortex XDR data. A Discovery BIOC rule can use various event types, such as file, injection…

Detection and Response Rules

Question

Options

AThreat Actor
BDiscovery
CNetwork
DDropper

How the community answered

(50 responses)

A
8% (4)
B
78% (39)
C
2% (1)
D
12% (6)

Explanation

The type of BIOC rule that is currently available in Cortex XDR is Discovery. A Discovery BIOC rule is a rule that detects suspicious or malicious behavior on endpoints based on the Cortex XDR data. A Discovery BIOC rule can use various event types, such as file, injection, load image, network, process, registry, or user, to define the criteria for the rule. A Discovery BIOC rule can also use operators, functions, and variables to create complex logic and conditions for the rule. A Discovery BIOC rule can generate alerts when the rule is triggered, and these alerts can be grouped into incidents for further investigation and response.

Topics

#BIOC rule#behavioral detection#rule types#Discovery

Community Discussion

No community discussion yet for this question.

Full XDR-ANALYST Practice