Security Forums

Does anybody know a way to get the creation date of an Entity? Also, if it has isEnriched set to True, can we get anyhow the date, the last enrichment happened?

Hey guys, was wondering, how can I control the outcome of the playbook in case that "Multi-Choice Question" using Approval Links is not getting answered under the given time (For example 5 minutes)? View files in slack

Another question, when I decline an action using Approval Links, this is the response I see in the playbook flow. The question is, how I can set a condition for that state? is_success = false isn't working. View files in slack

Hello All, can we make an entity out fields which are already coming with alerts of Cases, for example I have an alerts where I want to make the recepient email an entity and go further, wondering how to proceed with it. some guidance would be appreciated. thanks

Has anyone had any success getting the Duo Connector for the Duo Integration to work on 6.2.2.1 or 5.6.4.520?

Any way to escape Siemplify treating it as a placeholder? View files in slack

Hi all, is there a way to make it so that "generic" alerts from a connector are attached as events to the actual triggering alert? Thanks!

@Lokesh_Dachepal If you don't want to use a SIEM product, you can always do Windows event forwarding to get all logs to a centralized place. https://learn.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#bkmk-appendixc

Hey guys, I am facing difficulties trying to wait for a reply on Slack Question I executed in the playbook. It seems like the question is sent and there is no way of getting anything to rely on it but it being sent. Suggestion on a solution or alternatives would be highly appreciated.

Hi, How SOAR playbook will identify the credentials of a particular machine and do the remidiation; If we need to store the credentials somewhere in the phantom - Where we neeed to store them.

Hey all, how can I pass the entire event json to a block im calling? (What is the placeholder)

Hello all, I'm setting up a new integration and connector and was wondering if anyone could explain how to run an option for capturing old alerts after it's done? Essentially a lookback window? If so, is the methodology specific to each integration or is there a generalized process? Thanks in advance!

Have Remote Agents been tested on CentOS 8 or is there a hard requirement for CentOS 7?

Hello,I'm having a weird issue with Recaptcha Enterprise's authentication using Service Keys. I keep getting an unauthorized error (code 7) as a response every time I try to create an assessment despite the fact the Service Key has the required role, and the Recaptcha Site Key also exists. I'm also sure the Service Key is being located correctly since replacing it with another one from a different project I worked on (along with the appropriate Site Key) leads to the correct behavior, where I get an assessment and can interpret the score.Any idea what could cause such an error? Could I have missed something (although I did follow the guide's steps)?

Hello, I'm trying to export one playbook from my Siemplify Community Cloud instance. I see in the documentation that it is possible to export a playbook through an API call but it seems that I can't do it with a community version. Am I wrong ?If someone has a solution it would be great.Thanks

We would like to monitor logs from siemplify (specifically cloud connector logs as well as on prem logs)We would like to send them to our SIEM to monitor. How can we regularly pull these cloud and on prem connector logs in an automated fashion?

Hi,We recently added enterprise recaptcha to all of our sites. However, we are having a hard time tracking usage compared to the 1,000.000 free requests. What's the best way to setup a usage tracker for this?Which metrics should we be looking at to get an accurate picture of our current usage across the entire project? We have about 300 separate keys so we need it to be global. I've looked at these https://cloud.google.com/monitoring/api/metrics_gcp#gcp-recaptchaenterprise but not sure if this would include all the billable resources being used. We set up something with the Usage panel but it doesn't seem to match when I look at individual usage for keys.  Any ideas or help would be greatly appreciated.Thanks!

Hello Everyone, on a Siemplify Cloud instance (not community cloud), how can I access my instance's logs?

Hi Everyone! Is someone sending the Siemplify logs to their SIEM? I don't see how to do it. Thanks in advance!

i added a case manually, how can i use it to simulate a block? because i am getting this message View files in slack

Hello everyone, would anyone be able to help finding the inbox for incoming e-mails ? I couldn’t find any proper way for getting the mails except the “search email” function placed inside a playbook. Many thanks .

Hello Team, Can someone help me to find-out solution for below problem? This single case has total number of alerts 3, 1 of alerts is Truly malicious however other 2 are False. But the alerts club in same case. Now the challenge is If we will execute playbook it will take action against all the attach alerts. Is there any solution we can make these alerts separately club and our playbook action on a case don't create any issue? Also can tell me why this is happening? Thanks in advance

Hello Everyone, on a Siemplify Cloud instance (not community cloud), how can I access my instance's logs?

Hello team, could someone help me to find out how can I increase the 50 character limit for the case "tag" in Siemplify Version 6.1.35.1?

I've got an event field coming in with brackets that seems to be breaking the bracket notation. [Event.event.target[0].alternateId] is coming through as " [Event.event.target[0].alternateId] " instead of "Andrew Cook." Any ideas?