Hello all,
there is no current post regarding this topic, so I open a new post.
Is there any chance to ingest the IOC Matches from Google SIEM into Google SOAR as a new alert / case.
In the past I thought there was a connector function which allowed to directly create alerts based on the IOC Matches.
Or are there anywhere public IOC Detection Rules, which are reporting exactly the IOC Matches.
Thank you for your help.
~Marinus
Have you tried the Madiant Threat Intelligence integration?
You could also download the CSV from your screenshot, then import that in a custom list.
Have you tried the Madiant Threat Intelligence integration?
You could also download the CSV from your screenshot, then import that in a custom list.
Thank you for your answer.
But, the Mandiant Threat Intelligence integration won´t solve this issue, you can enrich existing entities in SOAR.
To import the CSV in a list for a rule and search for detections is also not a proper solution.
It is manual work and not proactive.
You can do it with a detection rule that matches the IOC data with your UDM events.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.