Google Security Operations

Any thoughts on how to strip things like Re: Fwd: and Fw: from email subjects via the ontology? These two regex patterns are close but have issues: (?i)[^(Fwd:) |Re: ].*,? (?:(?i)re: |fwd: |fw: )?(.*)

Anyone knows what the exact behavior of "Playbook priority" is or how it is used? Cannot find too much on it in the manual.

Hi Community, I am writing a custom package, and would like to import TIPCommon and EnvironmentCommon in my Connector code, but it errors out. I also tried adding them ad libraries to my package, but the "Libraries ____ Add" field couldn't find these two library. I also tried using "Script Dependencies +", but it errored out when I try to save. Can someone help? Many thanks!

Dear community, Please does anyone has a use case that download files from other solutions into Siemplify for pickup by another integration for analysis? My main question is if yes, are their any precautions in place for putting suspicious files on the platform? For example downloading a suspicious file from a phishing email to a file path on the platform so that it can be picked up and passed to a content analysis integration.

Has anyone seen or worked on any integration with PagerDuty?

Hi team, Is there a way of inside a customized integration to upload files from my computer to the siemplify server?

We sometimes face the challenge that the output of an action is intended to be displayed to the analyst (such as a Splunk search result in the form of a table), but doing that via an insight is limited by the rather small height of insights. Is there a way to provide a downloadable file (preferably csv or json) to the analyst which we e.g. create via TemplateEngine and store either in the case or in the filesystem?

Hi Team, How do we add several environments under one Environment/Category And would like to add a thought - can we utilize the "Domain" option in the Environment tab in the settings to achieve the same.

Hi Team, How I can monitor my networking through the Siemplify community Edition?

Does anyone know how to add multiple value of script result in placeholder and create new insights? Is it possible? Or Im need to create action block for every insight?

Any thoughts on where I'm going wrong trying to subtract 30 minutes from this timestamp using Functions > Convert Time Format ? The input is 2021-09-10T19:00:06.951Z and the broken output is %Y-%32-%5T%18:%9:%9.%f+0000 . I'd like to return 2021-09-10T18:30:06.951Z . I suspect it has something to do with my time format being off ( %Y-%m-%dT%H:%M:%S.%fZ )

I'm inside container with siemplify server and I'm not able to find config files (alas there is no /opt/siemplify/siemplify_server/Configs directory): # find /opt/siemplify/ -name Siemplify_Main_Config.xml # find /opt/siemplify/ -name CasePrioritization.config # find /opt/siemplify/ -iname '*ConnectorsEngine*' # These files are referenced in SCSO course (and in other places)... And I'm not sure what version i'm running: # cat /opt/siemplify/siemplify_server/bin/Siemplify.v

Hi team, I have some small questions about siemplify UI. Not sure if this is the right place to ask, but. Is possible to render images that were handled in the playbook on siemplify? I know for fact that we can download them on case wall, but I was wondering if siemplify is able to render and show to the user anywhere. Also, is possible to format text that is shown on insight and case wall? Something like bold, italic and larger fonts.. is possible to select more than one case and make bulk actions, such as delete? Thanks

Has anyone seen/heard/tried any Siemplify integration with Velociraptor? https://www.velocidex.com/ . We’ve been using it with great success and it’s a key piece of our endpoint strategy. It’s owned by Rapid7 now and continues to move in a good direction.

Hi, i just have a question about if it is possible to extract the number of events that shows in every alert that I have, I would use this number of events to multiple purposes like send an email alert, extract to csv, etc. View files in slack

Anyone know if there's a way to increase the # of cases shown on the left side (currently 15)?

Dear Community, has any one had a use case scenario where you had to create an entity such as 2 users in a case and needed to display an insight for this two separate users as in the case of active directory enrichment? Since the AD only contains an enrich all action, it will enrich both users, but haven't been able to come up with out to display insights seperately based on each user enrichment

Hi! If anyone know and can help me for my case: a) How can I re-run a Playbook on an Alert that has already executed it previously? b) How can I delete assigned Playbook from Alert? c) Can I run some Playbook from another existing Playbook (Playbook in Playbook)?

Can anyone tell why this condition took the "else" path (#2)? View files in slack

Hi everyone, I have some issues - how can we automatically add some IP addresses from entities located in the Alert to BlackList menu on Siemplify settings? I can’t find this type of actions in Playbooks. Could someone navigate me, please? Summary, goal is to add some IP addresses (from Entities Alerts) to BlackList directly from Playbooks.

Dear Community, please can anyone share how Siemplify is being leveraged in proactive threat hunting?

Hi, is it possible to use multiple triggers for a playbook?

Hello, I wonder if there is a way to create a timestamp with e..g. 14 dasy from now, using any built in actions? I see time format converter, get current time, but did not found how could I add +14 days, so I could use that new timestamp in my next action. Appreciate any hint, if it exists. If not, I will likely write a custom action of a few liner…

Hey Folks, is there anyone that knows where in the back end to reset the admin password of a siemplify community edition?

Hello all, how do I add enriched data to entity so that it will show in entity explorer I was told I can use flat_user_data = {"key1":"value1"} entity.additional_properties.update(flat_user_data) but it's throwing error how do I define entity?