Security Forums

I am looking for a solution to integrate chronicle with Github and Jenkins, but every time I get Bad request while feeding the data.

Once you've grouped actions together as a Parallel Action group, how do you ungroup those actions?

Is it possible to get the user who ran a playbook from within that playbook?

Hi how do i search for unparsed logs? My dashboard show 9 sysmon logs but no matter how i vary my search string, my search only returns 1 log event

HELP: While trying to deliver an email with approval links they get clicked automatically by the gmail sandbox, any way around it? If not @Tomtomfridman , is it possible to block a specific User-Agent from accessing the https service?

Hello All, how looks case with tableau in Chronicle? Is working and licensing as onprem siemplify version?

I'm trying to integrate google recaptcha entreprise in a next.js app, when I use a non test key, the returned token is always null, however it's returned fine when I use a test key. What is the problem please.Here is the github link for the repo: https://github.com/Seif-apprentus/Next-JS-Landing-Page-Starter-Template/blob/master/src/pages/login/index.tsx

Hi all. Do you know if there are any known issues with the jira integration? I'm trying to open a new issue on jira through a playbook but it fails with error "Failed to create issue in project TEST. Error is 'HTTPError' object has no attribute 'text' ". This looks like some python type exception. I double checked all the required fields doesn't seem be there.

Hi...Wanted to get detected file name, Path, hash, and other details from event from soar alert and update it in remedy note.Not sure how can i do it

Hi i'm searching for an API to monitor EPS for number of events ingested, parsed in UDM etc, Is there anything like this? not finding in documentation Im seeing this in dashboards but that seems to use looker which doesnt seem to have documented APIs for chronicle Thanks

Hi I'm trying to understand what are the default parsers actually doing mapping wise and looking for relevant documentation So far I found this https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers which lists the supported products but its not as detailed as this https://cloud.google.com/chronicle/docs/preview/default-parsers which explains in detail whats going on in the mapping Any idea where to find a full listing like in the second link for all the supported products?

anyone who has played around with ontology/fields mapping?

anyone has successfully used these three actions? https://chronicle-soar.elevio.help/en/articles/833 ??? was able to successfully use "Render Template", thanks to @recon_acook !

Hi Everyone, please, I need your response on this below. How do you update your cybersecurity knowledge for near real-time awareness on issues like:

hi experts reaching out to inquire about ingesting Microsoft MDE (Microsoft Defender for Endpoint) data into Chronicle. Is there any relevant documentation or guides that could assist me

Hello Team,Please help me to download Chronical SOAR installer or OVA file.Thanks,Priyash

When logging into the community edition, I receive an "account is disabled" message. How do I resolve this?It has been a while since I logged in last, and I probably failed too many login attempts.Thanks!

Hello,I have implemented recaptcha for a web page with a form.When I run locally from file in my browser I got the token but the validation is saying browser error.When I host in Azure I always get a null token despite I have a * for CORS domain.Can you please help?I have tried both version 3 and enterprise.this is the snippet of the call with version 3:grecaptcha.ready(() => {              grecaptcha              .execute("reducted")              .then((token) => {Adding an action on the execute call does not change anythingThanksLuigi

I have a web page with Google reCaptchav3. It allows to input an ID number, click a button and requests from database some results. If a user input an ID number and click the button, then it generates one reCaptcha token.An ethical hacker is requesting a LIST of ID numbers with just one token and implies to me that I should program my web page in order to prevent that.How could I prevent or avoid in my web page that a bot or hacker input a list of ID numbers using only one token? Honestly, I thought that was Google reCaptcha job. Thanks. 

Hi all, I was writing a YARA-L detection rule in the Chronicle editor and I need to match the string "C:\\Program Files" with a regex. So I wrote: re.regex($selection.src.process.file.full_path, `C:\\Program Files `) But the editor rise this error: parsing: invalid regex pattern: C:\\Program Files: error parsing regexp: invalid character class range: `\\Pr` The error disappear if I escape the backslash character. Someone knows the reason? Since I'm using back quotes shouldn't I be able to not escape the backslash as said in the reference at this link: https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#string_and_regex_literals

Hi everyone! Recently I've configured the Google Chronicle Alerts Connector in order to receive an alert on the SOAR everytime a rule in the SIEM is triggered. Now I need to catch within a playbook some informations that are stored in the meta section of the triggered Yara-L rule. These fields are mapped in chronicle SOAR as something like "detection_1_ruleLabels_1_FIELDNAME". The problem is that the number after "ruleLabels" is not static. For example the field "detection_1_ruleLabels_1_author" could be "detection_1_ruleLabels_7_author" for another alert in the same case. Did anyone know if there is a way to match something like "detection_1_ruleLabels_*_FIELDNAME" in a playbook?

Hi all, can we send logs to chronicle via intranet traffic instead of going over the internet?

I have a question: When Ingesting from GCS buckets using feeds management UI, it mentions that chronicle doesn’t need authentication for the bucket because it has internal user, is this user a global user or specific to that cloud account? Can i ingest arbitrary bucket i don’t own but know the address to without authentication as unstructured logs and be able to view some bucket contents in chronicle?

Hi there! Is there a way to simply inject syslog without any parser (because there is none available for the product itself yet) to get the raw log into the SIEM and to look into the format itself to create a parser later maybe?

Hi All, maybe someone will know, is there option to save search for other users? edit: Additionally, is possible to modify the view in search tab? e.g delete some columns.