Security Forums

am facing issue on Configure single sign-on (SSO) on edge browser and getting the below error.The list of SSO providers could not be loaded.Please assist me on this issue.

I can't downloaded chronicle, I have already registered for for free edition but still I can't even get a chronicle site Pls  I need help. Thank you 

Hi, If I want to send\\ receive emails to\\ from customers via a dedicated mailbox, what would be the best way to configure it? using the built-in SOAR email settings (customer configuration) or the exchange integration from the marketplace?

I have a doubt, I am making a playbook in which I use two actions (Get similar Case), in one of them I look at IPs and in another one I look at Users. The output of these actions is an array of case identifiers, how can I compare these 2 arrays to see if any of their elements match?

We have a Chronicle forwarder set up, and we plan to send logs to it. Logs will be sent over the internet, so we're looking to encrypt the syslog data coming from our servers (rsyslog for Linux, nxlog for Windows).How do we ensure that the Chronicle forwarder unencrypts those logs before sending them up to the cloud?

write a regex to capture value between @ and " for below string.[{\\"ActionType\\":\\"Forward\\",\\"Recipients\\":[\\"Katrina.Demon@whxyz.co.um\\"],\\"ForwardFlags\\":\\"None\\"}] which is whxyz.co.um in above string.  or help write a yara code for capturing the same.  I am trying below, but is it giving error. re.capture ($e.security_result.detection_fields.value, "\\["([^"]+)"\\]") = $Domain

Hi, CommunityWe have one of the chronicle script from https://github.com/chronicle/ingestion-scripts executing on GCP function and we are collecting data from ABC platform to chronicle.We are observed that we have successfully collected logs from the ABC platform and when we script try to forward collected logs to chronicle then we are getting below error.{    'code': 404 ,    'message' : 'Requested entity was not found.',    'status' : 'NOT_FOUND'}

I am trying to pull data by using the CSV Custom IOC feed from a GCP storage bucket. Looking at the Parser I structured the csv that is saved within the GCP storage based on the parser but When logs are ingested they are still coming in as "unparsed".1. Has anyone had any luck with that parser/feed?2. Does each column need to be filled (no empty values)?Any tips or guidance would be appreciated.

Good afternoon,I am currently trying to implement case assignments based on different shifts amongst the team - also known as shift roster. Is there any out of the box functionality that I will be able to use in order to achieve this ? I am currently trying to evade complexity by using custom lists, custom functions and so on.If this functionality is not present/available, how are you guys doing it ? Appreciate your feedback on this topic.

I want to change my Chronicle SSO provider using Google SSO, but facing this issue when trying to create Workforce Identity Federation. The Question is, Can't Google support using their provider for SSO? 

What is the issue with below extension code:  filter { json { source => "message" array_function => "split_columns" } if [debugContext][debugData][proxyType] != "" { mutate { replace => { "proxyType.key" = "proxyType" "proxyType.value" = "%{debugContext.debugData.proxyType}" } copy => { "event1.idm.read_only_udm.security_result.detection_fields" => "proxyType" } } } mutate { merge => { "@output" => "event1" } } }   Error: generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\

I'm trying to set up reCaptcha Enterprise in a React/Node.js application. I have successfully set up the reCaptcha to work on the frontend and it is generating a token and passing it to the backend for assessment. The problem I can't seem to get around is the Node.js assessment example code from Google breaks, giving a the message SyntaxError: Unexpected token '.'. Specifically, this seems to happen when creating a new RecaptchaEnterpriseServiceClient. I suspect there might be an issue with authentication using Application Default Credentials, but I haven't seen any evidence of errors in the backend logging.First, in the Google Cloud Console I give my IAM user roles for reCAPTCHA Enterprise Admin and reCAPTCHA Enterprise Agent.I'm running the backend in Docker. I use the gcloud cli to authenticate my IAM user on my host machine, generate the ADC and mount it on the backend container using docker compose.I added the environment variable for pointing the serv

What will be Impact on the logging capabilities if we have Office 365 Business Premium licenses (and not E3 or E5) for Chronicle SIEM and SOAR.

 Hello everyone,I am in the process of finalizing a parser, trying to debug the validation errors I recive when adding themutate {merge => {"@output" => session "event"}} Here I encountered a strange behavior of the response: it keeps changing, even though the code and the test log are the same. In a nutshell, if I repeatedly press the "Preview" button in the UI, without any changes to code/log, the validation result keeps changing.I noticed that, for how the code is now, there are 5 or 6 error messages and they seem to be chosen randomly each time. This makes debugging rather difficult.Update:After several investigations and after resolving the different errors, I was able to fix all the problems. Still, I am concerned: is this a normal behavior? Shouldn't the same code always produce the same error? Until the very end I had no way to see if the next error will be produced by my latest fixes or by a pre-exi

We are currently trying to get our feet wet in managing our own parsers in Chronicle. We have started with Virtru Email Encryption logs which are ingested as JSON. I have been through the documentation quite a bit now but feel that a little bit of help would go a long way. I found another post stating that we need to import as a single line, which I believe we can do. Here are the JSON fields we are trying to target in the log in BOLD:{ "id": "fa894a4a-9471-4cd1-a6d8-9ad9f26c6593", "object": { "type": "data_object", "id": "7ef24565-b549-4fab-8bef-7ea0402a5243", "name": "EHLERS.pdf", "attributes": { "attrs": [ { "key": "virtru:data:policy:type", "value": "file" }, { "key": "virtru:data:creator", "value": "cdward@example.org" }, { "key": "virtru:data:owner", "value": "cdward@example.org"

Hi Team,Other than fetching the cloudflare logs from a GCS bucket is there any way by which we can ingest cloudflare logs directly to chronicle?Any ideas are highly appreciated.

In Chronicle, UDM stands for Unified Data Model.But in some UDM fields, like the following, there is an "idm":-event.idm.read_only_udm.additionalWhat does "idm" stand for and what is its significance?

Hello,Can I create a rule that will alert me every time a new user is created in gcp? how?Thank you.

Hi Team,How can we check MFA logs/events  in Chronicle SIEM using O365 (log source).

Does anyone know 5 different use cases for arista switch for chronicle SIEM

Is there anyway of querying via a UDM search to find alerts that have triggered?Thanks

Google reCAPTCHA will start charging users who reach a certain usage threshold on April 1, 2024. Currently, I am in Taiwan. Before binding my credit card, I would like to confirm whether the billing company is "Google International LLC Taiwan Branch" or "Google International LLC"?

Hello,I am unable to view the statedump of my parser code.Raw log is as follows:  "resource": { "type": "k8s_container", "labels": { "container_name": "abc", "namespace_name": "default", "location": "us-central", "project_id": "xyz", "cluster_name": "test-cluster", } }  The following is my parser code with the statedump:  filter { json { source => "message" array_function => "split_columns" } for key, value in resource.labels map { mutate { replace => { "test.key" => "%{key}" "test.value" => "%{value}" } } statedump {} } }  Where am i going wrong? 

Is there any article /guide on how to update this? This is from dataflow job for pubsub to splunk -Log ingestion. Checking on Learn More link, I didn't find anything useful.    

Hi everyone this is my first post here and first I want to say that I am happy to be here in the community. I have a personal device Samsung Galaxy s23 ultra 5g with Verizon as carrier and I have been trying to figure out what to do with this issue for too long and I have been troubleshooting and working with my limited access and knowledge of the android 14 OS and the situation is more difficult with the additional One UI 6.0 via Samsung. However, it is a problem with the actual process of using the keys for verification and login. The keys will assign to the accounts either with usb-C or NFC perfectly it seems without a noticeable error or notification or indication of assignment issues and the accounts will finalize everything and then they will never allow the keys to authenticate or verify when the time comes to login or secure the account. I have attempted to use them across the various accounts and platforms that offer fido2 security key authentication and use through an andr