bioc_insert
Insert new BIOCs or update existing ones to manage behavioral indicators of compromise in Cortex XSIAM, with tenant-specific rule IDs for overwrites.
Instructions
Insert or update BIOCs
Insert new BIOCs or update existing BIOCs.
Note: The BIOC rule_id is tenant specific and can't be used across tenants. Inserting BIOCs with the same rule_id as an existing BIOC on that tenant will overwrite the existing BIOC.
You must have Instance Administrator permissions to run this endpoint.
[POST /public_api/v1/bioc/insert] · BIOCs
Example request body:
{
"request_data": [
{
"name": "TestBIOC",
"type": "EXECUTION",
"severity": "SEV_020_LOW",
"comment": "",
"status": "ENABLED",
"is_xql": false,
"indicator": {
"runOnCGO": true,
"investigationType": "FILE_EVENT",
"investigation": {
"FILE_EVENT": {
"filter": {
"AND": [
{
"OR": [
{
"SEARCH_FIELD": "event_sub_type",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "1",
"isExtended": false
},
{
"SEARCH_FIELD": "event_sub_type",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "2",
"isExtended": false
},
{
"SEARCH_FIELD": "event_sub_type",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "3",
"isExtended": false
},
{
"SEARCH_FIELD": "event_sub_type",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "5",
"isExtended": false
},
{
"SEARCH_FIELD": "event_sub_type",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "6",
"isExtended": false
}
]
},
{
"SEARCH_FIELD": "action_file_name",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "aaaaaa",
"EXTRA_FIELDS": [],
"isExtended": false
}
]
}
}
}
},
"mitre_tactic_id_and_name": [
""
],
"mitre_technique_id_and_name": [
""
]
}
]
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |