+1Is there any way to get the number of cases triggered by specific entities through SIEM search? Or would that need SOAR?
Trying to make a dashboard widget that shows a SIEM entity and the number of cases it has triggered. I want to use SIEM search instead of SOAR because SOAR entities are username unique, so the same person appears as multiple entities, while SIEM already has it aggregated under a single entity.
Is there a way to achieve this?
+16So get a count for the number of cases a particular user entity is involved in?
You could try something like this:
case.response_platform_info.response_platform_id = $case_id
case.alerts.metadata.collection_elements.references.event.principal.hostname = $princ_host
case.alerts.metadata.collection_elements.references.event.principal.user.userid = $princ_user
$princ_user != ""
match:
$princ_user
outcome:
$case_count = count_distinct($case_id)
order:
$case_count desc
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
