Google Security Operations

Hello Everyone, i wrote a python script that sends an authentication request, receives JWT and uses the token to pull events from a service, using rest api. the response is a json array. as initial phase, and to make things easier (i hope), I created a stadnalone script that doesn't require any parameters to be executed. I already installed Siemplify and was able to login, i also created an integration and imported the common libraries. but i'm stuck now, and i'm not sure how to proceed in order to execute the script, parse the results and eventually display them in the dashboard. appreciate your help.

Hi Team, Please help on my query, How can we distinct the values from event's data

@Idan Patelsky or someone else on the Siemplify team, are there any plans roadmapped for a playbook action that would assign the case to the current user? So for example, the user clicks "Execute" on a manual action or makes a selection from a multi-choice question action, and the next action would be to assign the case to the user. I submitted this as a feature request a while back, but I was just wondering if this is being considered yet.

Does anyone in the channel use the paid version of SOC Prime, particularly those in the MDR/MSSP space? I have been using and love their freemium version, but I scheduled a demo/call to get pricing on their paid version. The "Product Adoption Manager" emailed me the day before the demo, canceled the demo, and told me that "due to the Platform changes, we don’t have an applicable option for you" and encouraged me to continue using the Freemium version. I asked for clarification, but he merely told me again to continue using the Freemium version.

Hi good people I have downloaded the docker image to install siemplify and using the following command to install the docker image. However,i keep getting an error as "bash: syntax error near unexpected token `newline'" docker run --name siemplify -d -p 80:80/tcp -p 443:443/tcp -v /run -v /sys/fs/cgroup:/sys/fs/cgroup:ro siemplify/community:<docker_image_tag>

Hi! Playbooks from freshly installed and simulated use cases" are interrupted with an error in the first step: "Execution Failed: Scripts - SiemplifySimulator_Rename Case. Message: Object reference not set to an instance of an object" - do you have any ideas how to fix it?

hi community. I'm new to siemplify and am trying to check out the community edition. I've set it up via docker on a virtual CentOS box... the image seems ready, the ports are being listened on, but for some reason, I am getting no SYN/ACK to my SYNs... I'm not sure where to go from here. any tips on where to check additional configurations or any tips would be greatly appreciated

Hi community, I'm trying to use the action Get Alert Details from the integration of Recorded Futured but when I enter the parameter give me an error. " Missing mandatory parameter Alert ID View files in slack

Is there a way to use the API call CaseSearchEverything to return changed Cases for a given time interval? The filter criteria don’t seem to provide that capability. Thanks.

We aren't currently using the SLA feature so I was curious, for anyone that is using SLAs can you tell me a little bit about how you are using it?

Hi can I erase this directory? View files in slack

Morning, I've been trying to trigger a second playbook on all of my alerts, using the All trigger. As I mention it a second playbook. Is this possible or maybe a bug? thanks

Morning, I'm facing an issue with the ArcSight logger query action where it returns only the _rowid if "fields to fetch" is left blank. Any solution for this? View files in slack

Good morning all! Does anyone in the community use the VMWare NSX Defender platform (IDS/IPS formerly known as Lastline) and have it integrated with Siemplify? If so, did you have PS build you a custom integration or did you roll out your own?

Hi Team,I have configured Qradar connector it is running successfully but no case is ingested to siemplify anyone help me on to resolve this issue please

So here is a quick question: If Siemplify teams were preparing demonstration videos for helping you with more complicated platform usage, which issues would you like it to address? https://media.giphy.com/media/KAh25oQAiIWknS0JLM/giphy.gif \\

Any thoughts on how to strip things like Re: Fwd: and Fw: from email subjects via the ontology? These two regex patterns are close but have issues: (?i)[^(Fwd:) |Re: ].*,? (?:(?i)re: |fwd: |fw: )?(.*)

Anyone knows what the exact behavior of "Playbook priority" is or how it is used? Cannot find too much on it in the manual.

Hi Community, I am writing a custom package, and would like to import TIPCommon and EnvironmentCommon in my Connector code, but it errors out. I also tried adding them ad libraries to my package, but the "Libraries ____ Add" field couldn't find these two library. I also tried using "Script Dependencies +", but it errored out when I try to save. Can someone help? Many thanks!

Dear community, Please does anyone has a use case that download files from other solutions into Siemplify for pickup by another integration for analysis? My main question is if yes, are their any precautions in place for putting suspicious files on the platform? For example downloading a suspicious file from a phishing email to a file path on the platform so that it can be picked up and passed to a content analysis integration.

Has anyone seen or worked on any integration with PagerDuty?

Hi team, Is there a way of inside a customized integration to upload files from my computer to the siemplify server?

Pulling in the content of an email body as an insight occasionally results in This field contains large amounts of data. Download File to see its content. instead of displaying the content. Does anyone know the max size of an insight and the best way to limit the message body before trying to jam it in an insight?

We sometimes face the challenge that the output of an action is intended to be displayed to the analyst (such as a Splunk search result in the form of a table), but doing that via an insight is limited by the rather small height of insights. Is there a way to provide a downloadable file (preferably csv or json) to the analyst which we e.g. create via TemplateEngine and store either in the case or in the filesystem?

Hi Team, How do we add several environments under one Environment/Category And would like to add a thought - can we utilize the "Domain" option in the Environment tab in the settings to achieve the same.