When working with custom connectors in Google SecOps, it's often necessary to persist certain values, like offsets, to maintain state between executions. Identifying the best approach to save and retrieve these values ensures efficient and reliable operations.
It is required to save offset value when working with more than x,000 alerts through an OEM API. Events are accessible in batch of 10/100 per call and have to keep value of offset for next run.
If it is for duplicate identification in the TIPCommon library there are functions to read and write ids
from TIPCommon import read_ids, write_idsYou can find examples of how it is used in existing commercial connectors.
If you need something else to store, another option might be local file storage on Remote Agent.
More about TIPCommon: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/TIPCommon-Library-Installation
If it is for duplicate identification in the TIPCommon library there are functions to read and write ids
from TIPCommon import read_ids, write_idsYou can find examples of how it is used in existing commercial connectors.
If you need something else to store, another option might be local file storage on Remote Agent.
More about TIPCommon: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/TIPCommon-Library-Installation
nope.. it is not for duplication. It is offset value when working with more than x,000 alerts through an api. Events are accessible in batch of 10/100 and have to keep value of offset for next run.
nope.. it is not for duplication. It is offset value when working with more than x,000 alerts through an api. Events are accessible in batch of 10/100 and have to keep value of offset for next run.
You can explore VMware Carbon Black Cloud Connectors. They have the logic of recording IDs to backlog to read and process them later.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.