Security Forums

Hello All, is it possible to show the KQL Query which was used within the playbook in the html widgets? would be much appreciated!! best regards Mohammad Agha

Anybody start seeing this error anywhere after an upgrade? Siemplify.Common.Store.DependenciesInstallationException A custom integration we have that had been working reliably suddenly stopped working and now gives this error.

Is anyone else having issues with the playbooks not running in simulator mode? None of my playbooks that I have tested are working in prod or dev. I do have a ticket open

Is anybody able to give me more details on how to use the transformation function FROM_CUSTOM_DATETIME in the mapping configuration? I'm having a timestamp like the following in my event: 2023-02-22T02:05:40.000Z How do I transform it now, so that it will be succesfully mapped? Which parameters do I have to specify? The documentation ( https://chronicle-soar.elevio.help/en/articles/459-configure-mapping-and-assign-visual-families ) doesn't help with that.

Can anybody give me a hint on how to combine the Jinja TemplateEngine with HTML Templates? For testing purposes I've tried the following already: So how do I get this to work with an template?

Hey folks, Trying to implement some sort of risk-based alerting to the Chronicle. I know that Chronicle has risk_score in the outcome section but it doesn't allow me to tie in multiple events. For example - Day 1 - user A is going to leave the organisation - risk_score =5 Day -7 - user A is downloads a bunch of files to his personal email - risk_score=10 Day 10 - user B clones 10 repos - risk_score = 10 These are individual detection event. Now tie all this together and say if the user has crossed a particular threshold, then alert on it. For example - the above user A has exceeded the risk threshold 13 in the last 10 days, so needs to be investigated and not the user B because that might be just part of work. And maybe show an activity timeline of all the events as well. Any thoughts on this will be greatly appreciated (PS - we use Siemplify too - so if it can be done o

A couple questions around SCCP to Chronicle integration. -One, is there a way to enrich data around GCP projects and resources labels? -Two, SCCP sends a bunch of events/alerts for one resource. Does Chronicle automatically correlate these events or is there a way to do that?

Hi, does anybody know how to convert the output of a JSON which is a LDAP timestamp (18-digit Active Directory timestamps) into human readable format YYYY/MM/DD by any action or function available in Chronicle SOAR?

Does anyone have any advice on how you could create a dashboard to see the average amount of time between the initial log time and a detection firing based off of that log? If possible I would like to see the distributions of time based on log source as well.

Hello ,What is the difference between system fields and entity fields in the mapping area for specific connector? Thanks

I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.

The example provided on reCAPTCHA Enterprise frictionless assessment, uses the following rule to detect an action on the login page and allows it:request.path.matches(\\"/login.html\\") && token.recaptcha_action.score >= 0.8However, is not clear if the request.path on the rule refers to a Front-End (website) route or a backend route. If it refers to the latter: What is needed to craft an equivalent rule for a GraphQL endpoint? on GraphQL there is a single path /graphql using always the POST method for all the actions.Would be the rule below enough?token.recaptcha_action.action === 'login' && token.recaptcha_action.score>= 0.8What if an attacker decides to call directly to the API whe

In the documentation it seems that the arrays.contains function can be used like the following, arrays.contains($asset_id_list, "id_1234")Is it possible to use the function with two variables so I can compare the list with a value in a UDM field?The following code snippet shows a possible use case for this scenario:rule Example_rule_for_arrays { meta: author = "amalone" description = "Look for a spike in failed logins for a User account followed by a successful login from an IP address associated with a fail" severity = "Low" events: $fail.metadata.event_type = "USER_LOGIN" $fail.security_result.summary = /Failed/ nocase $fail.target.user.userid = $user $success.metadata.event_type = "USER_LOGIN" $success.security_result.summary = /Success/ nocase $success.target.user.userid = $user $fail.metadata.e

We are new to using reCAPTCHA enterprise and wanted to see if anyone has had firsthand experience on how to handle a situation when the reCAPTCHA endpoints are unavailable?Was there any try catch type code added to the webpage to avoid having issue at a later date?

Hello,I have implemented repatcha enterprise with the the score based assessment on on a register page.  At first a test website.Now I wonder what would be a non fraudulent score. If I use my email address I get a score of 0.89.Would it be ok if I assess all scores >= 0.7 as non-fraudulent? What would be a good starting point as a minimum score?I could log the scores and then compare the values over time. So I may could see what is a good minimum score.On the recaptcha enterprise website it states:"With low scores, require MFA or email verification to prevent credential stuffing attacks."Where could I set up MFA or email verification? Is there a documentation about it?Thank you for any recommendations. 

Is it possible to make a Yara-L rule that is detecting off of a specific field in the additional section?I have data in the UDM field:additional.fields["entity"].entity_payload.attachments.name = "test.exe" I do not know how to access data after the fields["entity"] section. The following rule shows what the rule would currently look like.  rule AM_Example_additional_rule { meta: author = "amalone" description = "Sample rule to chat about additional section" severity = "Medium" events: $e.additional.fields["entity"] = /\\.exe$/ condition: $e } From my testing this does not pick up on the data from the logs. 

Has anyone else had issue with how playbook priority works across multiple environments? For example, if I have two playbooks at the same priority and one is assigned to a specific environment and the other is assigned to "all environments" then I would expect the more specific playbook would run. How else can I create customer-specific playbooks without them getting clobbered by the general ones?

Is there an API endpoint where I can get detections / alerts from rules that aren't closed by administrators? Basically this quick filter, but for the API. I can't seem to find the closed field in the api results for any of the seemingly obvious endpoints - detections, alerts, etc. View files in slack

Hello Guys, After signup i am unable to login in community version, everytime it is showing invalid password or username, even if it is correct

Hi all, Chronicle SOAR quick question, could you let me know which is the character that marks the end of a line and the beginning of a new line in a playbook text entry? At the moment it all comes flat. Thanks

I wanted to throw this out for anyone in the community - what has everyone been doing to look at serverless compute within chronicle?

Can I install siemplyfy on redhat kvm on premise

EmailV2 - Send Email seems like I cant enforce a break-line using html tags, any hotfix available

Hey! I'm trying to add an another user to Chronicle SOAR community edition, but getting an error "An error occurred. Please contact your system administrator." It doesn't matter what's the type of user. Under the "license management" I can see there is space for a new user to be added

Is there a type of raw log search to view data stream given a certain log source?