Google Security Operations

We aren't currently using the SLA feature so I was curious, for anyone that is using SLAs can you tell me a little bit about how you are using it?

Hi can I erase this directory? View files in slack

Morning, I've been trying to trigger a second playbook on all of my alerts, using the All trigger. As I mention it a second playbook. Is this possible or maybe a bug? thanks

Morning, I'm facing an issue with the ArcSight logger query action where it returns only the _rowid if "fields to fetch" is left blank. Any solution for this? View files in slack

Good morning all! Does anyone in the community use the VMWare NSX Defender platform (IDS/IPS formerly known as Lastline) and have it integrated with Siemplify? If so, did you have PS build you a custom integration or did you roll out your own?

Hi Team,I have configured Qradar connector it is running successfully but no case is ingested to siemplify anyone help me on to resolve this issue please

So here is a quick question: If Siemplify teams were preparing demonstration videos for helping you with more complicated platform usage, which issues would you like it to address? https://media.giphy.com/media/KAh25oQAiIWknS0JLM/giphy.gif \\

Any thoughts on how to strip things like Re: Fwd: and Fw: from email subjects via the ontology? These two regex patterns are close but have issues: (?i)[^(Fwd:) |Re: ].*,? (?:(?i)re: |fwd: |fw: )?(.*)

Anyone knows what the exact behavior of "Playbook priority" is or how it is used? Cannot find too much on it in the manual.

Hi Community, I am writing a custom package, and would like to import TIPCommon and EnvironmentCommon in my Connector code, but it errors out. I also tried adding them ad libraries to my package, but the "Libraries ____ Add" field couldn't find these two library. I also tried using "Script Dependencies +", but it errored out when I try to save. Can someone help? Many thanks!

Dear community, Please does anyone has a use case that download files from other solutions into Siemplify for pickup by another integration for analysis? My main question is if yes, are their any precautions in place for putting suspicious files on the platform? For example downloading a suspicious file from a phishing email to a file path on the platform so that it can be picked up and passed to a content analysis integration.

Has anyone seen or worked on any integration with PagerDuty?

Hi team, Is there a way of inside a customized integration to upload files from my computer to the siemplify server?

We sometimes face the challenge that the output of an action is intended to be displayed to the analyst (such as a Splunk search result in the form of a table), but doing that via an insight is limited by the rather small height of insights. Is there a way to provide a downloadable file (preferably csv or json) to the analyst which we e.g. create via TemplateEngine and store either in the case or in the filesystem?

Hi Team, How do we add several environments under one Environment/Category And would like to add a thought - can we utilize the "Domain" option in the Environment tab in the settings to achieve the same.

Hi Team, How I can monitor my networking through the Siemplify community Edition?

Does anyone know how to add multiple value of script result in placeholder and create new insights? Is it possible? Or Im need to create action block for every insight?

Any thoughts on where I'm going wrong trying to subtract 30 minutes from this timestamp using Functions > Convert Time Format ? The input is 2021-09-10T19:00:06.951Z and the broken output is %Y-%32-%5T%18:%9:%9.%f+0000 . I'd like to return 2021-09-10T18:30:06.951Z . I suspect it has something to do with my time format being off ( %Y-%m-%dT%H:%M:%S.%fZ ) View files in slack

I'm inside container with siemplify server and I'm not able to find config files (alas there is no /opt/siemplify/siemplify_server/Configs directory): # find /opt/siemplify/ -name Siemplify_Main_Config.xml # find /opt/siemplify/ -name CasePrioritization.config # find /opt/siemplify/ -iname '*ConnectorsEngine*' # These files are referenced in SCSO course (and in other places)... And I'm not sure what version i'm running: # cat /opt/siemplify/siemplify_server/bin/Siemplify.version 5.6.1.89 # cat /opt/siemplify/siemplify_server/Version.txt 5.6.1.133 ;-)

Hi team, I have some small questions about siemplify UI. Not sure if this is the right place to ask, but. Is possible to render images that were handled in the playbook on siemplify? I know for fact that we can download them on case wall, but I was wondering if siemplify is able to render and show to the user anywhere. Also, is possible to format text that is shown on insight and case wall? Something like bold, italic and larger fonts.. is possible to select more than one case and make bulk actions, such as delete? Thanks

Has anyone seen/heard/tried any Siemplify integration with Velociraptor? https://www.velocidex.com/ . We’ve been using it with great success and it’s a key piece of our endpoint strategy. It’s owned by Rapid7 now and continues to move in a good direction.

Hi, i just have a question about if it is possible to extract the number of events that shows in every alert that I have, I would use this number of events to multiple purposes like send an email alert, extract to csv, etc. View files in slack

Anyone know if there's a way to increase the # of cases shown on the left side (currently 15)?

Dear Community, has any one had a use case scenario where you had to create an entity such as 2 users in a case and needed to display an insight for this two separate users as in the case of active directory enrichment? Since the AD only contains an enrich all action, it will enrich both users, but haven't been able to come up with out to display insights seperately based on each user enrichment

Hi! If anyone know and can help me for my case: a) How can I re-run a Playbook on an Alert that has already executed it previously? b) How can I delete assigned Playbook from Alert? c) Can I run some Playbook from another existing Playbook (Playbook in Playbook)?