Google Security Operations

Hi. We have been working on an API integration in SOAR and are running into a problem where the built-in Siemplify (ChronicleSOAR) IDE's debug output is throwing an error that it cannot interpret the JSON response being returned by our script: "Agent internal error: No JSON object could be decoded" - When testing the same script in an external IDE, it for sure is returning results in JSON, so I'm a little stumped.

I completed the Chronicle SIEM Fundamentals...is there anything available for more detail like there is for SOAR? Specifically want to get a deeper look into ingestion, normalization, enrichment, parsing, and rules But I can't find much in the way of training

Hi All, I have 2 cases where I need good advise and best practise. 1. How you handle cases where is two or more diffrent alerts. Im using playbook with close alert but I can't close last alert. How to handle that to prevent closing case after closing one alert? Is there a way to use something like "close alert, if is the last alert, close case"? 2. How do you made constantly conversation during case? Im using exchange integration, is possible to Chronicle will track diffrent conversation without knowledge about subject? How do you using this integration in playbook? Is there a way to monitor constantly a mailbox and paste answer in proper case?

Has anyone reliably integrated with Proofpoint TRAP? We are looking for python code that works for downloading incident detail.

Hello All, where can I find the documentations to show me how to configure one remote agent for multiple environments?

Would love to join

Hey all,I'm trying to get access to "SOAR Free Edition" via the link on the main homepage. Where it says "Don't have a user yet? Get here", I already have an account I created. When I then click on the picture it takes me to the SOAR login screen but my credentials don't work, it says "Invalid email and password". I imagine it's doing this because it doesn't have an associated account but as I described, I've gone through all the steps to make an account.Can anyone help?Thanks!

Hi. I've got a RFC 5424 Syslog message I am attempting to ingest into Google Chronicle using the REST ingestion API.  The vendor is Mako Networks. I do not see a parser for this particular vendor listed here (https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). Is there a vendor neutral Syslog parser for Chronicle? Do I need to convert this to UDM? Any guidance would be greatly appreciated? 

Hi, it looks like there are still issues in SOAR v6 (6.2.7.5) when it comes to the entity type DOMAIN. This is still not part of the SDK. Only SOURCEDOMAIN and DESTINATIONDOMAIN. For example, the urlscan.io integration doesn't work with entities of the type DOMAIN, because it checks if the entity type is one of those in the screenshot. When will that be addressed? View files in slack

second question: can we configure one agent for two environment? I have one simplify agent which I use to reach to my on-premis systems, but I have want to same agent in my test environment as well, how to proceed? thanks

Hi all, anybody knows if it's possible to use wildcards for entity identifiers in the Blocklist ( https://siemplify.elevio.help/en/articles/493-create-block-list-to-exclude-entities-from-alerts )? Otherwise, is there any other way to block the creation of entities, especially legit URLs without specifying every single URL?

Hi, Is there a way to configure Email EML Connector in chronicle SOAR to pull email from a gmail account? Google disabled the possibility to Turn on access for less secure apps and this is a requirement as per documentation here https://integrations.siemplify.co/doc/email-v2#overview

Not able to use Execute Command in Crowdstrike Falcon, getting error put is not available do you know why?

Hello everyone. do you know if there is a way to set dark theme on chronicle dashboard view? The rest of the pages have dark theme by default and looking at the source of the page I can see a css class called "theme" set to "dark". I can't figure out from where I can change the theme

Hi all, I want to attach an playbook to a number of cases via API or rerun a playbook respectively via API. I thought this would be pretty easy, but it looks like I need an parameter called "alertGroupIdentifier" besides the "cyberCaseId" and the "originalWorkflowDefinitionIdentifier". Anybody knows if this is possible without that value or how to query it easily based on case IDs?

Hello All, what are the "Alerts Grouping" options for Carbon Black products which works best according to your experience?? Currently for me it makes too many "Overflow Cases". would appreciate some hints and pointers best regards Mohammad

dear people, I´m currently working on a specific use case about detecting activity during non-working hours on an international environment with different timezones. do you know if is possible to prepare a single use case with different correlation Yara-L rules ( per each timezone there are different outcomes) and call them from a "centralized" yara-L rule? thanks in advance!

Hi everyone, I would like to find some information about splunk integration. Mainly Im interested about differences between push and pull option for taking alert from splunk. Anybody have experience in this matter? Now we are using push (from splunk) to chronicle (on prem btw) but I cant handle how to customize onthology, where can I test alerts like in common way using integration (pull from splunk).

Hey, i'm new to chronicle. i wanted to figure out if there's a way for a chronicle rule to populate a list upon a hit. appreciate the help !

looks like the 6.2.20 release notes ( https://chronicle-soar.elevio.help/en/articles/839-release-notes-6-2-20-april-2022 ) were saved under the year 2022 and don't show on the "latest release notes" page ( https://chronicle-soar.elevio.help/en/categories/162-latest-release-notes-cloud ) where 6.2.19 is shown as the latest dated April 2023

Hi, anyone know why I get this login error when trying to access my demo enviroment? I've just changed my name from settings. After the logout I'm not able to access anymore. View files in slack

Hi, is there a way to fully delete a case from Chronicle either using the GUI or through the api/a custom script?

Hello Team, I got this error when testing a phishing playbook any idea what this means or how to work around this? Could this be related to setting up the exchange connector View files in slack

Anyone familiar with iterating through the tags of a case from within an action? I tried looking into siemplify._get_case().cyber_alerts.tags but that is an empty list, even though my test case has multiple tags.

Hi all, we are trying to build an alert when chronicle siem ingestion would drop by 20% for a certain type of logs within an hour, does anyone have experience with something like this?