Security Forums

Hello ,What is the difference between system fields and entity fields in the mapping area for specific connector? Thanks

I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.

The example provided on reCAPTCHA Enterprise frictionless assessment, uses the following rule to detect an action on the login page and allows it:request.path.matches(\\"/login.html\\") && token.recaptcha_action.score >= 0.8However, is not clear if the request.path on the rule refers to a Front-End (website) route or a backend route. If it refers to the latter: What is needed to craft an equivalent rule for a GraphQL endpoint? on GraphQL there is a single path /graphql using always the POST method for all the actions.Would be the rule below enough?token.recaptcha_action.action === 'login' && token.recaptcha_action.score>= 0.8What if an attacker decides to call directly to the API where reCAPTCHA Enterprise doesn't exists? Maybe I am missing some piece of information but I don't see how the tool would solve this problem for a GraphQL endpoint.Any comment is greatly appreciated! 

In the documentation it seems that the arrays.contains function can be used like the following, arrays.contains($asset_id_list, "id_1234")Is it possible to use the function with two variables so I can compare the list with a value in a UDM field?The following code snippet shows a possible use case for this scenario:rule Example_rule_for_arrays { meta: author = "amalone" description = "Look for a spike in failed logins for a User account followed by a successful login from an IP address associated with a fail" severity = "Low" events: $fail.metadata.event_type = "USER_LOGIN" $fail.security_result.summary = /Failed/ nocase $fail.target.user.userid = $user $success.metadata.event_type = "USER_LOGIN" $success.security_result.summary = /Success/ nocase $success.target.user.userid = $user $fail.metadata.event_timestamp.seconds

We are new to using reCAPTCHA enterprise and wanted to see if anyone has had firsthand experience on how to handle a situation when the reCAPTCHA endpoints are unavailable?Was there any try catch type code added to the webpage to avoid having issue at a later date?

Hello,I have implemented repatcha enterprise with the the score based assessment on on a register page.  At first a test website.Now I wonder what would be a non fraudulent score. If I use my email address I get a score of 0.89.Would it be ok if I assess all scores >= 0.7 as non-fraudulent? What would be a good starting point as a minimum score?I could log the scores and then compare the values over time. So I may could see what is a good minimum score.On the recaptcha enterprise website it states:"With low scores, require MFA or email verification to prevent credential stuffing attacks."Where could I set up MFA or email verification? Is there a documentation about it?Thank you for any recommendations. 

Is it possible to make a Yara-L rule that is detecting off of a specific field in the additional section?I have data in the UDM field:additional.fields["entity"].entity_payload.attachments.name = "test.exe" I do not know how to access data after the fields["entity"] section. The following rule shows what the rule would currently look like.  rule AM_Example_additional_rule { meta: author = "amalone" description = "Sample rule to chat about additional section" severity = "Medium" events: $e.additional.fields["entity"] = /\\.exe$/ condition: $e } From my testing this does not pick up on the data from the logs. 

Has anyone else had issue with how playbook priority works across multiple environments? For example, if I have two playbooks at the same priority and one is assigned to a specific environment and the other is assigned to "all environments" then I would expect the more specific playbook would run. How else can I create customer-specific playbooks without them getting clobbered by the general ones?

Is there an API endpoint where I can get detections / alerts from rules that aren't closed by administrators? Basically this quick filter, but for the API. I can't seem to find the closed field in the api results for any of the seemingly obvious endpoints - detections, alerts, etc. View files in slack

Hello Guys, After signup i am unable to login in community version, everytime it is showing invalid password or username, even if it is correct

Hi all, Chronicle SOAR quick question, could you let me know which is the character that marks the end of a line and the beginning of a new line in a playbook text entry? At the moment it all comes flat. Thanks

I wanted to throw this out for anyone in the community - what has everyone been doing to look at serverless compute within chronicle?

Can I install siemplyfy on redhat kvm on premise

EmailV2 - Send Email seems like I cant enforce a break-line using html tags, any hotfix available

Hey! I'm trying to add an another user to Chronicle SOAR community edition, but getting an error "An error occurred. Please contact your system administrator." It doesn't matter what's the type of user. Under the "license management" I can see there is space for a new user to be added

Is there a type of raw log search to view data stream given a certain log source?

I wanted to do something simple, like decode a base 64 sting. I copied the function and added the code. When I run the new function in the IDE I see the desired output. When I run the function in a playbook however the function will just hang.I am not sure just why, bu

Hi , is it possible to loop in a PB through a list fetched using http get connector? and then create an alert for each of these items?

Chronicle SIEM: In my raw log I have a string exposure:external but this field is not in UDM. Is there a way specify a condition in rule to check for the string ? Or we cannot do that at all ?

Does anyone know if Google have a list of Rules which are available in Chronicle Security and are base on which logs source.

Hey, I'm trying to take a String Function result of a comma separated string, and loop through each of the values (again seperated by string) and print them using TemplateEngine in a nice way... For example here is the python equivalent: ScriptResult = "A,B,C,D" result_list = ScriptResult.split(",") for i in result_list: print(i) anyone knows how I can achieve same result with TemplateEngine?

Does anyone know how to add "G Suite" from https://www.siemplify.co/marketplace/search/?search=g+suite ? It doesn't show in Marketplace on the app

What’s been your experience sharing log parsers with people on this community? Has it been beneficial? Risky? Is GitHub the most common way to share?

Are there any plans for SecOps community meets - either online or irl? I..e. User meet n greets, birds of a feather, etc.

error: message":"Time 2023-01-24T21:29:16.478+0000 must be in ISO 8601 format"}' An error occurred: 400 Client Error: Bad Request for url: