Cortex XDR Behavioral Indicators of Compromise (BIOC) rules detect tactics, techniques, and behaviors rather than only static indicators such as hashes, domains, or IP addresses. Current Cortex XDR documentation allows analysts with the required XDR Pro licensing\/permissions to create custom BIOCs with XQL-based filtering, test them against historical tenant data, generate issues\/alerts on new matches, and\u2014in supported endpoint configurations\u2014use selected BIOCs as custom prevention rules.<\/p>\n
Within Palo Alto Security Operations<\/a>, BIOCs are most useful when threat hunting produces a stable behavioral pattern that should become repeatable detection or prevention.<\/p>\n The existing threat detection and incident workflows<\/a> article provides the broader detection-to-response model.<\/p>\n A BIOC can match process, registry, file, network, event-log, cloud-audit, and other supported telemetry conditions according to the dataset and rule syntax.<\/p>\n This makes it resilient to attackers changing one file hash or IP while repeating the same suspicious behavior.<\/p>\n Write the rule around the invariant technique you observed, then add exclusions for legitimate tools\/workflows rather than hard-coding one incident’s indicators.<\/p>\n Cortex XDR lets analysts define BIOC criteria using XQL Search. Current docs require at least filtering on Start from a known hunt query, then simplify it to the minimum stable fields required for detection.<\/p>\n Complex transformations or aggregations that make sense in a hunt may not be valid or efficient as always-on BIOC logic.<\/p>\n Palo Alto Networks explicitly recommends testing new or edited BIOCs because poorly refined rules can generate thousands of detections.<\/p>\n Test runs search existing tenant data and show historical matches.<\/p>\n Review representative hits, false positives, host\/user distribution, frequency, and expected business processes before enabling production alerting.<\/p>\n After a BIOC is created, Cortex XDR searches historical tenant data for initial matches and currently processes the first 10,000 hits according to the documentation.<\/p>\n After that initial scan, new matching events generate detections as telemetry arrives.<\/p>\n Account for this behavior during rollout so enabling a broad rule does not flood the SOC with old activity that analysts mistake for a current outbreak.<\/p>\n Assign severity based on the behavior’s likely consequence and confidence, not simply because the original incident was severe.<\/p>\n Cortex XDR lets BIOCs be associated with MITRE ATT&CK tactics\/techniques.<\/p>\n Use mappings that accurately describe what the rule detects so coverage reports and incident timelines remain meaningful.<\/p>\n Cortex XDR receives preconfigured global BIOC rules through content updates.<\/p>\n Current docs state global rules cannot be modified directly; analysts can copy a global BIOC to create an editable user-defined rule or add exceptions to the global rule.<\/p>\n Prefer exceptions\/copies to disabling valuable global coverage simply because one application creates benign matches.<\/p>\n An exception can suppress known legitimate behavior by process, path, user, host, or other relevant fields.<\/p>\n Every exception reduces detection coverage.<\/p>\n Add an owner, business justification, scope, and review date, and test that the exception does not suppress the malicious case the BIOC was designed to detect.<\/p>\n Supported Cortex XDR agents can use BIOCs as custom prevention rules through Restrictions profiles, allowing the endpoint to terminate a malicious process chain and generate behavioral prevention telemetry.<\/p>\n Move from detection to prevention only after false positives are understood.<\/p>\n A prevention rule that kills legitimate administrative automation can cause broader operational impact than an ordinary alert.<\/p>\n Version\/name rules clearly, document the threat hypothesis and source incident, test changes, track hit volume, review false positives, and retire rules whose technique is no longer relevant.<\/p>\nBIOCs describe behavior, not one artifact<\/h3>\n
Current custom BIOCs can be built with XQL filters<\/h3>\n
event_type<\/code> for a valid XQL BIOC and limit supported stages\/functions for this rule context.<\/p>\nTest the rule before saving it<\/h3>\n
Creation triggers an initial historical search<\/h3>\n
Severity and MITRE mapping improve triage<\/h3>\n
Global BIOCs are updated by Palo Alto Networks<\/h3>\n
Exceptions should be narrow and evidence-based<\/h3>\n
Custom prevention can stop the causality chain<\/h3>\n
BIOC lifecycle should follow detection engineering discipline<\/h3>\n