Detection rules ↗

Cortex XSIAM detection rules identify suspicious activity and generate issues for investigation.

Use IOC rules for known artifacts. Use BIOC rules for suspicious behavior. Use correlation rules to connect events across sources.

Explore detection rules

• what-are-detection-rules
• whats-an-ioc
• whats-a-bioc
• whats-a-correlation-rule
• manage-ioc-and-bioc-rules