Security Forums

Hello Team, I got this error when testing a phishing playbook any idea what this means or how to work around this? Could this be related to setting up the exchange connector View files in slack

Anyone familiar with iterating through the tags of a case from within an action? I tried looking into siemplify._get_case().cyber_alerts.tags but that is an empty list, even though my test case has multiple tags.

Guys, I have no idea where I should put this questionLast month we received an e-mail telling us that our reCaptcha quota had been exceeded and we had 90 days to upgrade do Enterprise. Yesterday we received the second e-mail. In both e-mail we had over 1 million requests per month, and that number does not match our traffic volume. We use reCaptcha in our Azure AD B2C license. The url is similar to "https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/etc"  and all the other Azure AD B2C clients have their instances running in a URL similar to that "companyname.b2clogin.com/etc"This alert started when we implemented reCaptcha in our Registration form. We know that roughly 20k users get to this page monthly. We have the following questions before upgrading to Enterprise (because something seems to be wrong):1- what counts as a request for reCaptcha V2? If the widget is printed, the user interacts with it and then our backend verify the token, then 1, 2 or 3 reque

Hi all, we are trying to build an alert when chronicle siem ingestion would drop by 20% for a certain type of logs within an hour, does anyone have experience with something like this?

Hello team, working on a phishing playbook looking to generate a response that contains a pdf document for the end-user to fill out and send back. Any tips or guidance on this?

Hello there, do you know if a ready cbn conf file for MISP_IOC exists?

Hi everyone, I was wondering how I can ingest MISP data to chronicle for enrichment. I would like to ingest the data with a forwarder that I use to ingest other data already. My question is: how I should define the collector section of my configuration file?

Hello, I'm having troubles configuring my linux forwarder. I've completed the setup as per documentation but I don't get any log on the SIEM. Any hint?

Hi everyone, I´m looking for the Chronicle SIEM API full description, with all the parameters . By calling https://backstory.googleapis.com/ I don´t receive anything. I couldn´t find the full API documentation anywhere, any clue? Thanks!

Hello, any plans to make a Chronicle SOAR training other than the old ones from Siemplify?

i need some good websites/reference for having kube use-cases. Please share the link if anyone come across.

My clients with slow internet connections have encountered issues with passing reCaptcha. The issue can be reproduced by throttling internet connection speed (for example, to 2G) and attempting to pass reCaptcha. Requests to the reCaptcha API are aborted after 5 seconds on slow connections. I have tried to find a way to override this 5-second abort, but there is no information about it in the reCaptcha documentation.I would like to know if there is any way to increase this 5-second abort or some other way to handle slow internet connections in this case?Reproducible on demo (https://www.google.com/recaptcha/api2/demo) by throttling download speed to 40kbits and upload speed to 10kbits.    

Hi guys, I´m searching for a good YARA-L course or training for some colleagues, Does anyone know about any? Thx!

Hi guys, What is the difference between entity fields and system fields in the mapping? View files in slack

Hi guys, I dont understand what is product level mapping. Why it is needed? is the product information comes with events? View files in slack

Has anyone been having issues with the "Test Rule Results" windows in rules editor not showing any detections but when you turn the rule on it generates alerts?

Hello All, is it possible to show the KQL Query which was used within the playbook in the html widgets? would be much appreciated!! best regards Mohammad Agha

Anybody start seeing this error anywhere after an upgrade? Siemplify.Common.Store.DependenciesInstallationException A custom integration we have that had been working reliably suddenly stopped working and now gives this error.

Is anyone else having issues with the playbooks not running in simulator mode? None of my playbooks that I have tested are working in prod or dev. I do have a ticket open

Is anybody able to give me more details on how to use the transformation function FROM_CUSTOM_DATETIME in the mapping configuration? I'm having a timestamp like the following in my event: 2023-02-22T02:05:40.000Z How do I transform it now, so that it will be succesfully mapped? Which parameters do I have to specify? The documentation ( https://chronicle-soar.elevio.help/en/articles/459-configure-mapping-and-assign-visual-families ) doesn't help with that.

Can anybody give me a hint on how to combine the Jinja TemplateEngine with HTML Templates? For testing purposes I've tried the following already: So how do I get this to work with an template?

Hey folks, Trying to implement some sort of risk-based alerting to the Chronicle. I know that Chronicle has risk_score in the outcome section but it doesn't allow me to tie in multiple events. For example - Day 1 - user A is going to leave the organisation - risk_score =5 Day -7 - user A is downloads a bunch of files to his personal email - risk_score=10 Day 10 - user B clones 10 repos - risk_score = 10 These are individual detection event. Now tie all this together and say if the user has crossed a particular threshold, then alert on it. For example - the above user A has exceeded the risk threshold 13 in the last 10 days, so needs to be investigated and not the user B because that might be just part of work. And maybe show an activity timeline of all the events as well. Any thoughts on this will be greatly appreciated (PS - we use Siemplify too - so if it can be done on a combination would welcome that too)

A couple questions around SCCP to Chronicle integration. -One, is there a way to enrich data around GCP projects and resources labels? -Two, SCCP sends a bunch of events/alerts for one resource. Does Chronicle automatically correlate these events or is there a way to do that?

Hi, does anybody know how to convert the output of a JSON which is a LDAP timestamp (18-digit Active Directory timestamps) into human readable format YYYY/MM/DD by any action or function available in Chronicle SOAR?

Does anyone have any advice on how you could create a dashboard to see the average amount of time between the initial log time and a detection firing based off of that log? If possible I would like to see the distributions of time based on log source as well.