About Virus and Disable

Do these work in cases where bosses use indirect attacks? Like for the bird and Garuda attacks in Xelphatol's final boss fight?

Only attacks actually channeled by the mob you disable/virus as far as I know.

I believe that they work on all attacks, regardless if they're channeled or not. The only caveat would be a non sch/smn, in which case it's mostly for physical busters and auto attacks.

Only way to tell is try it out and watch the numbers, but IMO, the Garuda summon in that particular case likely works in one of two ways

1) Garuda is summoned with it's own stats, which are a reflection of the bosses stats, in which case Disable and Virus should make Garuda weaker if active on the boss as she's summoned
2) Garuda isn't really treated as a summon, but rather she was designed as a mechanic for the fight. Meaning she has no real stats of her own and could either be a standardized potency (meaning Virus/Disable would have no impact) or her attack is treated as the bosses attack (in which case Virus/Disable would work).

I feel like option 2 is more likely, given the static way in which she behaves in that fight. So it really depends on how they designed that particular mechanic. A similar but different mechanic from another fight may be designed differently.

In general, these moves do not work on "indirect" attacks if they're cast from an alternative source. For instance, during the Alexander Prime fight he summons the giant Alexander which is responsible for many of the attacks throughout the fight--none of these attacks are mitigated by Virus/Disable on the boss. T9 is also a better example to visualize this, as none of the outer dragon breath damage, pillar hits, or falling meteors can be mitigated by either move given they are not sourced as coming from Nael herself. Often you will need to determine where an attack's source is treated as coming from in order to tell if it will help, or just try it out and see if it works.

Additionally Virus does not normally mitigate "unaspected" damage, which occasionally shows up in encounters, particularly raids. This means damage attacks that are not flagged as either magic or physical. However Disable will still mitigate these regardless of its type.

As for Garuda in Xelphatol, it's as the above says. If Garuda is treated as a separate source then they likely won't, but if it's considered a delayed continuation of the boss's "Summon Garuda" spell, then the agency is still with him so it might.