Google Security Operations

Hi everyone, I have an issue and wondering if any of you could help. I installed the elastic integration and added a connector for it with the index in which alerts are stored. It is working, however when I hit "run connector once" I get only the first alert of the selected timeframe over and over again. And also even if the connector is started the inflow of alerts doesn't happen, I can only get new cases if I run the connector manually.

Does anyone have the webhook.site integration up and working? I'd like to try to use it to integrate with the "Ask a Question" buttons in the Slack integration, but there isn't very much documentation on the webhook.site integration.

Hey everyone , I’m using the SaaS product ,and for SentinelOneV2 integration I’m trying to get the “filePath” field to appear as a target field inside ontology mapping page, to parse and use the values received back from the API ,Someone knows if it is possible to add custom target fields ? or even modifying the name of an exciting one ? another thing I would like to ask is what is the correct way to implement SLA inside playbook and overall in the system ,for multi environments . Thanks !

Good Day all. I am trying to setup a connection to Windows Defender ATP on the cloud platform but I get the below error message. The integration is tested and working but creating the connector is failing. The connector config is setup as per the setup manual. Anyone had the same issue?Reading already existing alerts ids...Key: "ids" does not exist in the database. Returning default value instead: []

is there a way to take a json result from an HTTP GET and convert to base64 within siemplify? I'm overlooking if such an action exists. Thanks

Having trouble Creating Entities of IPs that I have parsed using regex. When using the create entity tool it is reading separate IP addresses as one long string. View files in slack

Hey folks. I'm trying to write an HTML View for cases (data is coming in from Splunk). And I'm running into a problem. If a case has a single event then the entity I might reference would look like this: In which case the string in the "description" field of my Splunk alert is shown without issue. However, if the case has multiple events then the string that is shown is a concatenated list of all of the "description" strings from every event separated by a comma. I am looking for an entity name that always shows up for that data and is always just the first event. I've seen at times. But that only seems to show up if there are multiple events (or maybe for multivalue fields?) Are there any resources for understanding how Siemplify m

Hi everyone! I was wondering if someone else faced the issue where an imported "Block" does not have the "Dynamic mode" for instances? Everything is fine if i create a brand new block.

Hi everyone! I was wondering if someone else faced the issue where an imported "Block" does not have the "Dynamic mode" for instances? Everything is fine if i create a brand new block.

Hi all, do anybody encountered the python2 / python3 print error with SentinelOne threat connector? Exit code: 1. Script output: Script did not return expected data. Did you call build_result/end_script? Check DebugOutput for details. Debug output: File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/SentinelOneV2_V27.0/liia0ptu.wkm/1mer5uud.pce.py", line 251 print "Main execution started" SyntaxError: Missing parentheses in call to 'print'. Did you mean print("Main execution started")?

Hi, Team, one more question. I want to use Siemplify to generate a daily email notification. I created a Connector that will create a Case, and the case will trigger a playbook to send out the email. I set the Connector to "Run Every 1 Days 0 Hours 0 Minutes 0 Seconds". It currently triggers at 4:27PM EDT. How do I make it to trigger at 8AM EDT instead? I tried disable the Connector and re-enable it at 8AM, but it still stick with 4:27PM. Could anyone kindly clarify how the Connector decides on the exact trigger time? Many thanks!

I'm still confused about the Docker image. Is it available for the community edition. If so, how does one acquire it?

Hi Team, does Siemplify have the ability to retrieve password field values of any Siemplify Integration on-the-fly from a password vault? For example, we are using "Active Directory" and "Exchange" integration in our Siemplify cloud tenant. Both integrations require an AD account and its password to be entered in the Integration. We have to set the AD account to use non-expiring password, otherwise have to manually update Siemplify Integration whenever the AD account password expires. We have license of a password vault tool, and it can periodically update password for AD accounts . It will be great if we can set a configuration between Siemplify and that password vault tool, and then in any Siemplify Integration, we can tell Siemplify to retrieve the password from the password vault, instead of entering the password value in the Siemplify Integration. Does Siemplify has that type of feature currently or have that plan in the roadmap? Thanks!

Hi team, is there a way to display the timestamp in human readable format in the table report/csv export from ArcSight Logger query results? View files in slack

Hi Everyone, I have an issue with my McAfee ESM connector after the upgrade to siemplify version 6, When I test the connector work properly but the alerts are not ingested and the log show me the next error, someone has this error before on a connector? View files in slack

Hi Team, If I want to call list of Alert names using custom list, will I be able to call it?

Hi team, is there a way to display the timestamp in human readable format in the table report/csv export from ArcSight Logger query results? View files in slack

is there a way to take a json result from an HTTP GET and convert to base64 within siemplify? I'm overlooking if such an action exists. Thanks

Hi, Team, one more question. I want to use Siemplify to generate a daily email notification. I created a Connector that will create a Case, and the case will trigger a playbook to send out the email. I set the Connector to "Run Every 1 Days 0 Hours 0 Minutes 0 Seconds". It currently triggers at 4:27PM EDT. How do I make it to trigger at 8AM EDT instead? I tried disable the Connector and re-enable it at 8AM, but it still stick with 4:27PM. Could anyone kindly clarify how the Connector decides on the exact trigger time? Many thanks!

Hi Everyone, I have an issue with my McAfee ESM connector after the upgrade to siemplify version 6, When I test the connector work properly but the alerts are not ingested and the log show me the next error, someone has this error before on a connector? View files in slack

Hi Team, If I want to call list of Alert names using custom list, will I be able to call it?

Having trouble Creating Entities of IPs that I have parsed using regex. When using the create entity tool it is reading separate IP addresses as one long string. View files in slack

Dear Community, Please has anyone come across this error below before while trying to create a job?

Hi Team, How can we convert time to readable format, if value is 1 we can use function time converter. If more then 2 what we can do?

Existe un sitio malicioso que se le revocó el certificado SSL, sin embargo, Chrome lleva semanas indicando que el certificado es válido.Otros navegadores como Edge y Firefox ya actualizan la información y muestran el certificado como inválido.Esto es un grave problema de seguridad a nivel mundial, porque si el certificado de un sitio malicioso es revocado pero Chrome continúa respaldando el sitio, los estafadores tienen un aliado en Chrome.¿Cómo se le puede indicar al equipo que desarrolla Chrome que un certificado de SSL fue revocado para que lo actualice en todos los navegadores?