Tag: Cortex XSIAM

Convert Sigma DNS Rules to Cortex XSIAM with Uncoder AI How It Works Uncoder AI reads a Sigma rule designed to detect DNS queries to malicious infrastructure used by Katz Stealer malware, and instantly translates it into native Palo Alto Cortex XSIAM syntax. Left Panel – Sigma Detection: Targets DNS queries to specific Katz Stealer […]

How It Works This Uncoder AI feature analyzes a complex CERT-UA#1170 threat report describing the LITERNAMAGER malware family and generates a Cortex XSIAM-compatible XQL rule. The AI extracts structured indicators and behaviors, then maps them to different Cortex datasets: 1. Process & Command Line Activity The rule detects suspicious command-line execution of: YOURClient.exe YOURServer.exe including […]

How It Works Uncoder AI translates threat intelligence into Cortex XSIAM detection logic by ingesting structured IOCs and extracting relevant execution behaviors. This example focuses on the WRECKSTEEL campaign (CERT-UA#14283), a PowerShell-based stealer that abuses native tools and network requests to exfiltrate data. On the left, Uncoder AI parses dozens of SHA256 hashes, filenames, scripts […]

As attackers become more creative in bypassing traditional network defenses, analysts need fast, clear insight into the logic behind complex detection rules. That’s where Uncoder AI’s Full Summary feature becomes a game-changer—especially for teams working with Palo Alto Cortex XSIAM Query Language (XQL). In a recent use case, Uncoder AI helped threat hunters break down […]