Security Forums

Hello everyone, Please can someone elaborate on this, differentiating between Group entities and source grouping identifiers and what happens when this is toggled on ? Group entities and source grouping identifiers in the same case

Hey all, Are there any guides for the TemplateEngine integration (Specifically for the Entity Insight action?) The only writeup I can find are the two previous ones by Rob but they only talk about the "Render Template action" Cheers

Hi community, anyone has experience in implementing MITRE ATT&CK on playbooks, I want to implement it but I don't know how to use it, my log source is a SIEM QRadar.

Hi when using the Filter in the expression builder is it possible to search for a sub-string in a string? The filter operation 'in' seems to match only on the entire string?

Hi folks... taking advantage of the community questions support, because you're all so knowledgeable (Thanks in advance) Does anyone know if it's possible to "save a search" in the UI? ...or maybe just a more advanced syntax for the search parameters by URL, e.g. mysiemplify.com/#/main/search?Caseids=256&Caseids=28&Caseids=201&Caseids=4&time=352&tags:Manual,Auto1,Machine2 ...including more than just the basic 4 fields here? (NB. I'm looking for a way which doesn't have to be UI driven through filter selection on the left panel of the search...) View files in slack

Does anyone know if there is a way to poll a case for open alerts and then close the case if there aren't any through a playbook action?

there are playbook action placeholders for lots of entity types, but not for internal users. is there an easy way to get that same info that i'm overlooking (such as the output from a tool action or similar)?

Hello, everyone! I’m configuring my CSV connection, and I’ve changed the title of my CSV file multiple times, but Ontology still giving me the initial version of my CSV file, as seen in the first image below, even though I’ve previously changed it.

Hi, Hello, I’m attempting to run a basic local case to test my playbook, but I’m having trouble setting up my local csv connector. Can someone assist me with this error? thanks a lot. [13:48:29,000 INFO] Csv Folder Path: /root/conantest.csv [13:48:29,000 INFO] CSV Limit: 10 [13:48:29,000 INFO] DeviceProductField: device_product [13:48:29,000 INFO] Time Field Name: timestamp [13:48:29,000 INFO] Time Field Timezone: UTC [13:48:29,000 INFO] Environment Field Name: conantest [13:48:29,000 INFO] Environment Regex Pattern: .* [13:48:29,000 INFO] Rule Generator Field Name: conantest [13:48:29,000 INFO] CSV Has Header: true [13:48:29,000 INFO] File Encoding Types: utf-8, latin-1, iso-8859-1 [13:48:29,000 INFO] Alert Field Name: conantest [13:48:29,000 INFO] Severity Field Name: 10 [13:48:29,000 ERROR] Unable to create folder: [Errno 13] Permission denied: '/root/conantest.csv' LOGGER: loadCon

Hello, Please I have a question on the entity selection, is there a way to display or use those entities selected in the playbook step individually?

Hello, please can someone direct me on how the query joiner works? These are the screenshot below of what i tried and error i was getting. Just trying to explore the action to see if it can accomplish my aim

Hey community, I am new to siemplify, I just installed Community OVA in VirtualBox, chose Bridged Adapter, en0: Wi-fi. But when ssh to the vm to ip addresses show, I don't see an IP address from enp0s3 interface, as explained in step 14 as below https://www.manula.com/manuals/siemplify/quick-start-guide/5.6.x/en/topic/deploy-community-ova-in-virtualbox My VirtualBox is running on a MacBook Pro host, using wifi. Any suggestions?

Ok last question (for now).  What is UDM (Unified Data Model)?

Hi,When projects in GCP are in shut-down state, will Security Command Center remove all project-related vulnerabilities (vulnerabilities for all resources within the project)?As far as I see, non of them is removed, vulnerabilities still remain.Should we wait for 30-day period for the projects to be deleted, after which vulnerabilities will be automatically removed? Or will we have to mark them one-by-one with security marks?Thanks in advance for an answer.Best Regards,SBG

Is there any documentation on how to get started with Chronicle?

I have a new team member, how do I get them access to Chronicle?

One more question - how can I contact Chronicle Support?

Does anybody have an AbuseCH Malware Bazaar integration up and running yet? I am working on one and wondering if there would be interest from others to integrate into their environment.

I know the grouping based on the entities and the time frame. to be more precise which time will it consider for the grouping? Is the base event (start time/ end time) or the alert ingestion time into Siemplify like (Triage time) . Kindly confirm?

How or witch tool should I use to monitore por example seven endpoints at my local network