XDR-ANALYST · Question #8
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?
The correct answer is D. event_type. To create a BIOC rule with XQL query, you must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. The event_type field indicates the type of event that triggered the alert, such as PROCESS, FILE, REGISTRY, NETWORK, or USER_ACCOUNT. Filtering on…
Question
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?
Options
- Acausality_chain
- Bendpoint_name
- Cthreat_event
- Devent_type
How the community answered
(28 responses)- A11% (3)
- B4% (1)
- C4% (1)
- D82% (23)
Explanation
To create a BIOC rule with XQL query, you must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. The event_type field indicates the type of event that triggered the alert, such as PROCESS, FILE, REGISTRY, NETWORK, or USER_ACCOUNT. Filtering on this field helps you narrow down the scope of your query and focus on the relevant events for your use case. Other fields, such as causality_chain, endpoint_name, threat_event, are optional and can be used to further refine your query or display additional information in the alert.
Topics
Community Discussion
No community discussion yet for this question.