Security Forums

HelloI'm visualising rule detection dashboard on my instance I want to know what is the difference between count for drill and count as mentionned in the screenshot.Thanks 

i have these values from the events which is MME file typebut some events have 3 values ,4 values ,5 values -which unpredictablei want to capture all these MME File type in a single field what is the best way to do it

HiI was wondering if there is an official list of activityKind?I see activitykind in wall data json for a given id. Can figure out some but would be great to have the official list of activity Kind ThanksNeha

Hi, reading the official doc it says that is necessary to install RHEL 8.7 or centos 7.9, but manual installation only.If i do as docker deployment, can i run Ubuntu as primary OS? Thanks!

Hi,What is the best way to export large amounts of results from (very) broad queries? It seems that the SecOps UI only shows and allows the exporting of 1,000,000 events when very broad queries are executed. I want to export a large amount of parsed event data (more than 20 million individual events) and analyse the data through pandas on python. I understand that I can do this through the SecOps API or through BigQuery, but are there any costs incurred through these processes? Would there be any more efficient methods that I could try out?Thank you very much.

Does the order of the events section affect rule performance?For example, in this rule, would moving the ref list further up in the section help?$e.metadata.vendor_name = "Microsoft"$e. metadata.product_name = "Windows"$e.target.process.comand_line = /powershell.exe/$e.security_result.action = "BLOCK"...not $e.principal.user in %excludedusers

Hey all, I'm attempting to create a detection rule that brings in data across 3 different log_types:Azure_AD Microsoft Defender EndpointMicrosoft Graph AlertWhen I start to add Azure_AD in to the mix I am running into an error where it says "validating intermediate representation: event variables are not all joined by equalities, the joined groups are: (azure_event), (graph_event), (mde_event)".Now looking at my logic I'm not quite sure what the error is meaning. What I really want essentially is whenever Defender generates an alert this detection rule will also bring in events across the other two log types based on shared fields. Is that not possible with 3 log_types cause It works perfectly if I remove Azure_AD. Any help is appreciated!Here is my current rule: rule microsoft_security_alerts { meta: author = "Cody Brandt" description = "This rule looks for MDE alerts with High or Medium severity across multiple log types" status = "Production" severity =

How do i login to my arcaptcha

I'm currently trying to run a query with the run UDM query action in the "Google Chronicle" integration. When testing my query in the siem search it works and it's returning results, but when I try to run it within this action in a playbook I get this odd error:"Error executing action Google Chronicle - Execute UDM Query. Reason: SIEM tenant short-lived service account email not found in SOAR context."Any help would be appreciated. Thanks!

HiI had integrated a log source named "CRADLEPOINT_NETCLOUD" at the time i kept the namespace value in the forwarder as "Cradlepoint_NetCloud_Logs" , later today i had to modify the namespace value "cradlepoint-netcloud-logs-usa" as such for some reason . Now i am seeing the logs containing both the name space .Although at the forwarder config there is only new namespace .Can someone tell reason for this ?

Hello team,Some of our alerts are grouped into one case because of a similar IP Address (0.0.0.0).When trying to exclude this specific IP on the Blocklist page (Don`t group \\ Don`t create entity), it keeps showing the IP and group by it.What might be the reason for that?

Hi, I'm trying to combine a number of our failed login rules into one rule as we are nearing our detection rule capacity however I appear to be getting the following error regardless of what I try and change.semantic analysis: match variable user is not assigned to an event fieldI've tried using different variables, only working with the variable assigned to the target.user.userid udm field and a few other ideas but nothing seems to resolve the issue. Any suggestions would be much appreciated, I've added the rule syntax below for context. events: ( // Panorama_Firewall_Excessive_Failed_User_Login_10mins $e.metadata.log_type = "PAN_FIREWALL" and $e.metadata.product_event_type = "SYSTEM - auth" and $e.metadata.vendor_name = "Palo Alto Networks" and $e.metadata.description = /failed authentication(.*|$)/ and $e.principal.user.userid = $user ) or ( //Dell_IDRAC_Multiple_Failed_Login_10Mins $e.metadata.log_type = "IDRAC" and $e.additional.

Hi,I have a working playbook with multiple blocks. To make changes in one of the block i made a copy of the block and did lot of changes , tested it and now wanted to replace this new block with the existing one.I tried to delete the original block and rename the new one with the same one, But still the playbook show block deleted.Please guide me how to replace the new block with the old one.Regards,Laxmikant

I am using the Create Entity action and trying to create entities for internal ips and domains in a playbook. I do not want to create entities for external entities. For entity type, I select internal and i checked the "is internal" box in the action. Why is the action creating entities for external entities not included in these settings - https://cloud.google.com/chronicle/docs/soar/admin-tasks/configuration/manage-networks

Has anyone here in the Google SecOps Community encountered errors to find reports when setting up a connector for ArcSight? I am presently getting an error that the report specified in the connector is not found, even though the report exists in the ArcSight console. Has anyone else encountered this before?  

Can someone help me whether the below query qualifies as a recurring malware on  host use case rule host_with_recurring_malware_infection{ meta: author = "A" description = "Detects recurring malware infection on the same host based on malware hash." severity = "Low" events: //Detection logic goes here $event.metadata.event_type = "PROCESS_LAUNCH" $event.metadata.vendor_name = /Cylance/ nocase $event.metadata.product_name = /PROTECT/ nocase $event.metadata.product_event_type = /Threat/ nocase $event.security_result.summary != /(Waived|Cleared)/ nocase $file_hash = strings.coalesce($event.target.process.file.md5, $event.target.process.file.sha256) $file_name = $event.target.process.file.full_path $targeted_host = strings.to_upper(strings.coalesce($event.target.hostname, $event.principal.hostname)) match: $targeted_host over 60m outcome: $risk_score = max(40) condition: #event > 1 } 

Good day all, Is there a way to stop duplicate entities from being created on a specific case? For example, I am using the exchange connector and creating an entity per discovered URL. I'm looking at a case now that has 20+ URLs but really only 5 unique URLs.

Hi all,I know the API to get all the completed jobs in json format: https://<director>/jobs.json.Is there an API to get only the scheduled jobs (https://<director>/jobs?filter=scheduled) in json format?And after getting the list of jobs, is there an API to see the details of each scheduled job? Such as when it was scheduled and which actors are used?Thank you,Paolo

I have a GCP project where we have Artifact Registry with Container Analysis enabled.It publish events of the analysis to a pub-sub topic  name projects/PROJECT_ID/topics/container-analysis-occurrences-v1.  I have configured a push  subscription to this topic from the GCP project which belongs to Chronical SIEM. I have used the endpoint generated as per my Feed and also used the chronical-sa-ingestion service account.But it seems the feed do not get data .  Any suggestions how to debug or any documentation will be really helpful! 

Google's recaptcha verify responded with internal error: timeout-or-duplicate: The response is no longer valid: either is too old or has been used previously. Expected user input to be valid. Will return a CaptchaError type within the ruleErrors fields We have global websites but started seeing exceptions from last week only for India store. Is anyone aware about any issues with recaptcha at google ? We have not deployed any new code and suddently started seeing issues.

I am trying to create a custom action in google secops SOAR in which I am fetching some data and it needs to be matched with corresponding logs in chronicle SIEM. How I cam achieve this ? Is there any corresponding module or API way or both ?

Hello CommunityHas anyone made the switch from QRadar to Chronicle? What were the biggest challenges and benefits you encountered?Also , How did you approach translating your QRadar network hierarchy into Chronicle ?

Hi Guys,I integrated Freshservice ITSM with SOAR. When I am trying to create ticket getting below error:There is no option to add department_id or group_id in the action. Does anyone know the cause?Thanks,  

I'm trying to extract ip and hostname from a nested json. There are multiple ips and hostnames depending on the alert category. How can we extract and assign all the IPs and hostnames  it to target.ip  and target.hostname?{"target": {    "total_count": 2,    "data": [      {        "device": [          {            "value": "10.10.10.10",            "type": "ip"          },          {            "value": "abc",            "type": "hostname"          }        ],

we have created custom description UDM filed which needs to be updated using playbook with user information.Question - can we update UDM field?question : how to update alert description ? i can see action to update case description but not alert description ?