Google Security Operations

is there a way to take a json result from an HTTP GET and convert to base64 within siemplify? I'm overlooking if such an action exists. Thanks

Having trouble Creating Entities of IPs that I have parsed using regex. When using the create entity tool it is reading separate IP addresses as one long string. View files in slack

Hey folks. I'm trying to write an HTML View for cases (data is coming in from Splunk). And I'm running into a problem. If a case has a single event then the entity I might reference would look like this: In which case the string in the "description" field of my Splunk alert is shown without issue. However, if the case has multiple events then the string that is shown is a concatenated list of all of the "description" strings from every event separated by a comma. I am looking for an entity name that always shows up for that data and is always just the first event. I've seen at times. But that only seems to show up if there are multiple events (or maybe for multivalue fields?) Are there any resources for understanding how Siemplify makes entities related to Splunk events?

Hi everyone! I was wondering if someone else faced the issue where an imported "Block" does not have the "Dynamic mode" for instances? Everything is fine if i create a brand new block.

Hi everyone! I was wondering if someone else faced the issue where an imported "Block" does not have the "Dynamic mode" for instances? Everything is fine if i create a brand new block.

Hi all, do anybody encountered the python2 / python3 print error with SentinelOne threat connector? Exit code: 1. Script output: Script did not return expected data. Did you call build_result/end_script? Check DebugOutput for details. Debug output: File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/SentinelOneV2_V27.0/liia0ptu.wkm/1mer5uud.pce.py", line 251 print "Main execution started" SyntaxError: Missing parentheses in call to 'print'. Did you mean print("Main execution started")?

Hi, Team, one more question. I want to use Siemplify to generate a daily email notification. I created a Connector that will create a Case, and the case will trigger a playbook to send out the email. I set the Connector to "Run Every 1 Days 0 Hours 0 Minutes 0 Seconds". It currently triggers at 4:27PM EDT. How do I make it to trigger at 8AM EDT instead? I tried disable the Connector and re-enable it at 8AM, but it still stick with 4:27PM. Could anyone kindly clarify how the Connector decides on the exact trigger time? Many thanks!

I'm still confused about the Docker image. Is it available for the community edition. If so, how does one acquire it?

Hi Team, does Siemplify have the ability to retrieve password field values of any Siemplify Integration on-the-fly from a password vault? For example, we are using "Active Directory" and "Exchange" integration in our Siemplify cloud tenant. Both integrations require an AD account and its password to be entered in the Integration. We have to set the AD account to use non-expiring password, otherwise have to manually update Siemplify Integration whenever the AD account password expires. We have license of a password vault tool, and it can periodically update password for AD accounts . It will be great if we can set a configuration between Siemplify and that password vault tool, and then in any Siemplify Integration, we can tell Siemplify to retrieve the password from the password vault, instead of entering the password value in the Siemplify Integration. Does Siemplify has that type of feature currently or have that plan in the roadmap? Thanks!

Hi team, is there a way to display the timestamp in human readable format in the table report/csv export from ArcSight Logger query results? View files in slack

Hi Everyone, I have an issue with my McAfee ESM connector after the upgrade to siemplify version 6, When I test the connector work properly but the alerts are not ingested and the log show me the next error, someone has this error before on a connector? View files in slack

Hi Team, If I want to call list of Alert names using custom list, will I be able to call it?

Hi team, is there a way to display the timestamp in human readable format in the table report/csv export from ArcSight Logger query results? View files in slack

is there a way to take a json result from an HTTP GET and convert to base64 within siemplify? I'm overlooking if such an action exists. Thanks

Hi, Team, one more question. I want to use Siemplify to generate a daily email notification. I created a Connector that will create a Case, and the case will trigger a playbook to send out the email. I set the Connector to "Run Every 1 Days 0 Hours 0 Minutes 0 Seconds". It currently triggers at 4:27PM EDT. How do I make it to trigger at 8AM EDT instead? I tried disable the Connector and re-enable it at 8AM, but it still stick with 4:27PM. Could anyone kindly clarify how the Connector decides on the exact trigger time? Many thanks!

Hi Everyone, I have an issue with my McAfee ESM connector after the upgrade to siemplify version 6, When I test the connector work properly but the alerts are not ingested and the log show me the next error, someone has this error before on a connector? View files in slack

Hi Team, If I want to call list of Alert names using custom list, will I be able to call it?

Having trouble Creating Entities of IPs that I have parsed using regex. When using the create entity tool it is reading separate IP addresses as one long string. View files in slack

Dear Community, Please has anyone come across this error below before while trying to create a job?

Hi Team, How can we convert time to readable format, if value is 1 we can use function time converter. If more then 2 what we can do?

Existe un sitio malicioso que se le revocó el certificado SSL, sin embargo, Chrome lleva semanas indicando que el certificado es válido.Otros navegadores como Edge y Firefox ya actualizan la información y muestran el certificado como inválido.Esto es un grave problema de seguridad a nivel mundial, porque si el certificado de un sitio malicioso es revocado pero Chrome continúa respaldando el sitio, los estafadores tienen un aliado en Chrome.¿Cómo se le puede indicar al equipo que desarrolla Chrome que un certificado de SSL fue revocado para que lo actualice en todos los navegadores?

Hello community... I am wondering if anyone can share any lessons learned from handling phishing reports in Microsoft Office 365. Currently we are looking at onboarding phishing reports by having Exchange "CC" phishing reports to a mailbox, then use the Exchange connector to read these messages and analyze them. I think this approach will work, but we also have access to "Microsoft 365 Defender", which is it's own SOAR tool. When I look into that portal, I see MS already has done the hard work of grouping phishing and malware reports together into "incidents" and performing a fair amount of initial analysis of the reports. It seems a shame to ignore all of Threat Intel in Siemplify. Does anyone have a success story to share in pulling together this data into Siemplify?

This post was originally sent by Seifollah Akbari hey ! I signed up for the Siemplify Community but have not received the welcome to the community email.

Hello all, new here. I am attempting to use the emailv2 integration (also the general Email Settings for system-wide out going mail) with an Office365 mailbox but I am unable to get a successful test. I think it may be due to Security Defaults being enabled on Office365 but not sure. I also tried using a test Outlook.com account but no dice there either. Am I out of luck until we get the paid version and use the official Exchange email integration? thanks!

Hello Community, how are you? I hope all well. Has anyone had any impersonation problems when setting up an Exchange integration? We did all the procedure listed in the KB: https://integrations.siemplify.co/doc/exchange The first time in an environment using the Community edition, it worked without problems, but when we went to bring this configuration to the final version, we got the impersonation error again. If anyone can give me a hint, I would be very grateful. Thanks.