Google Security Operations

Hi Community, I just tried importing a subnet list (Settings -> Environments -> Networks) with ~1450 lines, but was stopped by Siemplify informing me there's a maximum of 1000 lines allowed. While my FR to raise this limit is ongoing: Does anybody know of a way to do a matching of IP-entities against a list of CIDR address ranges, and the smallest matching range would be returned in the result?

I tried switching from "Okta" to "custom SAML provider" this morning, but Siemplify gave me an error "there was an error updating SAML settings". I tried checking the individual logs below /var/log/siemplify/services, but couldn't find anything about it. Where would I be able to find a log telling me why it may fail? View files in slack

Quick question community. On the alerts grouping. The grouping time starts the moment a case is created and has nothing to do with the time on the alert it ingested into the platform, is this right?

Hi All, Just wondering if there are any Jinja gurus about, i seem to be having a daft issue with my Jinja templating. I've tried every obvious syntax but can't seem to get it right. I'm essentially want to do an If statement within a for loop, the if conditional is to check whether item.port == a declared value. If I manually set the value in the if statement it works, but passing the value in as a var doesn't. I suspect I'm not getting the syntax on the if correct. {% set targetport = %} Target Port: {{ targetport }} {% for item in EntityResult|sort(attribute="qid")%} {% if item.port == targetport %} The above shows the if condition. I've tried using == {{ targetport }} all sorts. If i replace == targetport with == 995 in an alert where that is true, then everything works. Any recommendations welcomed,

Hi All, The SOAR cases have a priority (informative, low, medium, high, critical), what is the criteria you use to assign priority to the cases?

Hello fam, got a question for ya'll: Suppose I have an alert that contains an entry like device=xyz Suppose I am able to query historical data and determine information like: device=abc, seen 50 times device=lmk, seen 25 times I'd like to basically answer this question: "is the alerted on device within the typically seen historical devices?" In this case, the answer would be no . I know I can write a custom action to do this, but I'm trying to stay within the Siemplify cage for supportability. Also, this is eventually intended to be sent out with a Cisco DUO MFA Integration, Connector and Usecase that'll be shared Suppose my question would be: How can I do this? Let's say the API query will return all the devices seen, but won't count how many occurrences. So I'll need something to count occurrences, account for a threshold, compare to

Hello everyone, Please can someone elaborate on this, differentiating between Group entities and source grouping identifiers and what happens when this is toggled on ? Group entities and source grouping identifiers in the same case

Hey all, Are there any guides for the TemplateEngine integration (Specifically for the Entity Insight action?) The only writeup I can find are the two previous ones by Rob but they only talk about the "Render Template action" Cheers

Hi community, anyone has experience in implementing MITRE ATT&CK on playbooks, I want to implement it but I don't know how to use it, my log source is a SIEM QRadar.

Hi when using the Filter in the expression builder is it possible to search for a sub-string in a string? The filter operation 'in' seems to match only on the entire string?

Hi folks... taking advantage of the community questions support, because you're all so knowledgeable (Thanks in advance) Does anyone know if it's possible to "save a search" in the UI? ...or maybe just a more advanced syntax for the search parameters by URL, e.g. mysiemplify.com/#/main/search?Caseids=256&Caseids=28&Caseids=201&Caseids=4&time=352&tags:Manual,Auto1,Machine2 ...including more than just the basic 4 fields here? (NB. I'm looking for a way which doesn't have to be UI driven through filter selection on the left panel of the search...) View files in slack

Does anyone know if there is a way to poll a case for open alerts and then close the case if there aren't any through a playbook action?

there are playbook action placeholders for lots of entity types, but not for internal users. is there an easy way to get that same info that i'm overlooking (such as the output from a tool action or similar)?

Hello, everyone! I’m configuring my CSV connection, and I’ve changed the title of my CSV file multiple times, but Ontology still giving me the initial version of my CSV file, as seen in the first image below, even though I’ve previously changed it.

Hi, Hello, I’m attempting to run a basic local case to test my playbook, but I’m having trouble setting up my local csv connector. Can someone assist me with this error? thanks a lot. [13:48:29,000 INFO] Csv Folder Path: /root/conantest.csv [13:48:29,000 INFO] CSV Limit: 10 [13:48:29,000 INFO] DeviceProductField: device_product [13:48:29,000 INFO] Time Field Name: timestamp [13:48:29,000 INFO] Time Field Timezone: UTC [13:48:29,000 INFO] Environment Field Name: conantest [13:48:29,000 INFO] Environment Regex Pattern: .* [13:48:29,000 INFO] Rule Generator Field Name: conantest [13:48:29,000 INFO] CSV Has Header: true [13:48:29,000 INFO] File Encoding Types: utf-8, latin-1, iso-8859-1 [13:48:29,000 INFO] Alert Field Name: conantest [13:48:29,000 INFO] Severity Field Name: 10 [13:48:29,000 ERROR] Unable to create folder: [Errno 13] Permission denied: '/root/conantest.csv' LOGGER: loadCon

Hello, Please I have a question on the entity selection, is there a way to display or use those entities selected in the playbook step individually?

Hello, please can someone direct me on how the query joiner works? These are the screenshot below of what i tried and error i was getting. Just trying to explore the action to see if it can accomplish my aim

Hey community, I am new to siemplify, I just installed Community OVA in VirtualBox, chose Bridged Adapter, en0: Wi-fi. But when ssh to the vm to ip addresses show, I don't see an IP address from enp0s3 interface, as explained in step 14 as below https://www.manula.com/manuals/siemplify/quick-start-guide/5.6.x/en/topic/deploy-community-ova-in-virtualbox My VirtualBox is running on a MacBook Pro host, using wifi. Any suggestions?

Ok last question (for now).  What is UDM (Unified Data Model)?

Hi,When projects in GCP are in shut-down state, will Security Command Center remove all project-related vulnerabilities (vulnerabilities for all resources within the project)?As far as I see, non of them is removed, vulnerabilities still remain.Should we wait for 30-day period for the projects to be deleted, after which vulnerabilities will be automatically removed? Or will we have to mark them one-by-one with security marks?Thanks in advance for an answer.Best Regards,SBG

Is there any documentation on how to get started with Chronicle?

I have a new team member, how do I get them access to Chronicle?

One more question - how can I contact Chronicle Support?

Does anybody have an AbuseCH Malware Bazaar integration up and running yet? I am working on one and wondering if there would be interest from others to integrate into their environment.

I know the grouping based on the entities and the time frame. to be more precise which time will it consider for the grouping? Is the base event (start time/ end time) or the alert ingestion time into Siemplify like (Triage time) . Kindly confirm?