Security Forums

So I am facing a situation which is as follows : I have this field, metadata.description"new user: name=swiagent, UID=995, GID=749, home=/opt/SolarWinds/Agent, shell=/sbin/nologin"I want to extract this name swiagent and strore it in a variable say $user. Can I do something to store the part after "=" and before ","How am I supposed to do that in yara L ?I need this to make a usecase user account created and deleted in a short interval. Similarly, I want to extract the 2 strings after the usermod -aG command i.e. testgroup and testuser_hehe1 in 2 different varaibles. metadata.description"root : TTY=pts/0 ; PWD=/home ; USER=root ; COMMAND=/usr/sbin/usermod -aG testgroup testuser_hehe1"Can someone tell me how to code for the same?

Hello,I am a webdesigner. For many of the websites I build for my clients, I set up a ReCaptcha for the website forms. In 2019, this turned into a "paid" service, for which I get an invoice for €0,00 every month, as the number of clicks stays well below the number from which actual payments are incurred. In most cases, I set this up with a gmail account of my client, and added my own Google account so I could manage the ReCaptcha for them if necessary. Bottom line: about 30 different recaptchas in my account. To my dismay, this month I received an invoice for an actual payment. I checked on the site, but the setup is so unbelievable unclear for these Google tools, I cannot make out which sites incurred this traffic, and why it would be billed to me, instead of the the client's Google account.Can someone explain to me please which account(s) is/are billed on incurring costs with a recaptcha? I hope I selected the proper Cloud Form, but it was unclear to me which one I should use.Thank y

Q 1:  limitations around the alerts ingested into SecOpsQ 2: Different options to perform grouping by different conditions

rule linux_user_account_created {  meta:    author = "ABC"    description = "User created"    severity = "Low"    priority = "Low"  events:    $e.metadata.vendor_name = "Linux"    $e.metadata.product_name = "AuditD"    $e.metadata.description = /new user/ nocase    $e.principal.user.userid = $user    $e.principal.hostname = $srcHost  match:    $user over 1m  outcome:    $risk_score = max(20)    $alertDescription = array_distinct(strings.concat("'A new user '", $user , "' was created on the linux server with the hostname'", $srcHost))  condition:    $e}So I have this field called, metadata.event_timestamp"2024-10-05T10:15:18Z"I want to convert this timestamp into IST (preferably in DD/MM/YYYY h:m:s format) and use it in the alertDescription variable. How am I supposed to do it? 

Hi, I’d like to ask where the alert data on SecOps is sourced from. Additionally, is this data available for further research and use in developing tools related to alert analysis?These data are from this page, which is the demo website of SecOps:https://demo.backstory.chronicle.security/alerts?filtersOperator=AND&filters=%5B%7B%22type%22:%22feedback_summary.status%22,%22operator%22:%22!%3D%22,%22values%22:%5B%22CLOSED%22%5D%7D%5D&timeRange=%7B%22start%22:%222024-09-25T05:25:48.090Z%22,%22end%22:%222024-09-28T05:25:48.090Z%22%7D

So I am writing few rules for detcting windows events.The first one is : rule A_security_enabled_local_group_was_deleted {    meta:    author = "ABC"    description = "This event generates every time a new security-enabled local group was deleted."    severity = "Low"  events:    $e.metadata.vendor_name = "Microsoft"    $e.metadata.product_event_type = "4734"  outcome:    $risk_score = max(20)  condition:    $e}Any suggestions? so as how to do this. Like what details can I include and how to proceed. @AymanC  @jstoner 

Hi If i am onboarding a log source via syslog using Chronicle forwarder , is it encrypted when in transit towards the Secops . Also if i want to onboard a log source which does not have internet connection ,how is this achievable ? 

Security Command Center now supports dynamic mute rules, which allow you to mute future and existing findings temporarily until a specified date or indefinitely until a finding no longer matches the configuration. We are adding these rules as an alternative to the original static mute rules that only mute future findings indefinitely. We recommend using dynamic mute rules exclusively in your mute rule configurations because they are more flexible than static mute rules. Compared to static mute rules, dynamic mute rules have three key benefits: Dynamic mute rules apply to existing and new findings. Dynamic mute rules automatically mute both existing and new or updated findings that match your filter criteria. Dynamic mute rules offer an expiration option. Dynamic mute rules also allow you to set a custom expiration period to temporarily match specific findings. If no expiration period is set, dynamic mute rules mute findings indefinitely until they no longer match the rule. Dynamic mut

One common use case that I have seen at several customers is that they want their SecOps or Operations folks have the ability to monitor that MSV Actors are up and available. To prevent false alarms, a script was created to "ping" the actors.  The script can be put on a scheduled CRON or be ran manually as a part of the playbook.  Feel free to take a look at the Python below and use as needed. For simplicity, I did not include the code to create the HTTPs session to the Director. # Get the list of non-protected actors def setup_data_fields():     global nodeData, evalData     response = session.get(f'https://{director_ip}/topology/nodes.json')     if response.status_code != 200:          print('Unable to get node information from director.')          sys.exit(-1)     nodeData = json.loads(response.text) # get the list of protected actors def setup_data_fields2():&nbsp

So I have this code written to detect a landspeed anomalyrule  impossible_travel_activity{  meta:    author = "Anurag Singh"    description = "Detects potential account compromise by identifying logon attempts from two different geo locations within a short span of time, indicating impossible travel between the locations."    severity = "High"  events:    $e1.metadata.event_type = "USER_LOGIN"    $e1.metadata.product_event_type = "UserLoggedIn"    $user = $e1.target.user.userid     $e1_lat = $e1.principal.location.region_coordinates.latitude    $e1_long = $e1.principal.location.region_coordinates.longitude    $location1 = $e1.principal.ip_geo_artifact.location.country_or_region    $e2.metadata.event_type = "USER_LOGIN"        $e2.metadata.product_event_type = "UserLoggedIn"    // match variables    $user = $e2.target.user.userid &nbs

Hey TeamHow can i filter logs before sending it via chronicle forwarder and Chronicle ingestion API, is it possible? For example i want to discard some maintenance specific logs  from Palo alto .if i am doing it via Forwarder how can i achieve this and if i am doing via ingestion APi how can i achieve this. 

1) Grouping can be done for how long (Duration)2) Can it support the grouping rule by rule basis (Every rule has its own criteria)3) On every frequency does it create a new case? or the alerts will be throttled for amount of time specified.. 

Hi Team,I want to create a replica of Executive summary report to Dashboard and it requires the x axis and y axis fields to create a dashboard, can someone assist me whether we have any option to do so.Thanks,Neha.H

Hi @All,I’m trying to enable Security Command Center (SCC) Premium programmatically for my Google Cloud project. However, I couldn’t find a clear way to do this in the documentation. If it’s possible to enable SCC Premium programmatically, could someone guide me on how to do it?Any code snippets, API references, or step-by-step instructions would be greatly appreciated.Thanks in advance for your help!

So I have a code for Lateral Movementrule Lateral_Mov {  meta:    author = "Anurag Singh"    description = "Vertical Lateral Movement"    severity = "Medium"events:    $e1.metadata.vendor_name = "Microsoft"    $e1.metadata.product_event_type = "4625" // Failed Logon    $e1.principal.hostname = $hostname    $e1.target.user.userid = $user        $e2.metadata.event_timestamp.seconds > $e1.metadata.event_timestamp.seconds    $e2.metadata.vendor_name = "Microsoft"    $e2.metadata.product_event_type = "4624" // Successful Logon    $e2.principal.hostname = $hostname    $e2.target.user.userid = $user    $e3.metadata.event_timestamp.seconds > $e2.metadata.event_timestamp.seconds    $e3.metadata.vendor_name = "Microsoft"    $e3.metadata.product_event_type = "4720" // New Account Creation    $e3.principal.hostname = $h

Hello all,I just came across the v1alpha API endpoint "logTypes.create" (link)I thought it had to be requested and then provided by Google.Does it mean that SecOps customers are autonomous for custom log_type creation ?If so, what is Google advice for the choice of the "logTypeId" parameter that will be associated to the log_type ?

Is there a good way to be able to manage case stages via playbooks where cases have multiple grouped alerts?We're using case stages to calculate metrics such as MTTR. If we have a case with a single alert, then we can make the alert playbook change the case stage to "Resolved" as part of closing the alert. But if a case has multiple alerts, we need that to only happen once the last alert on the case is resolved.We can't see any supported way to achieve this, such as a way to add conditional logic to a playbook based on the status of all other alerts in the same case.How are others handling this scenario?

Hello, I'm trying to scan a web app and i am getting the error message "Errors occurred when browsing startup URLs during analysis. Check the login credentials and start URLs, and make sure the site is working correctly."My credentials are working on a browser, the app is also working properly. Is there a way to get detailed logs about the error ? I can only see "STARTING_URLS_CRAWL_HTTP_ERRORS" on the actual logs.Thank you for your help

Hi All,I just got started with SOAR about a month ago and while fetching information about closed cases via "Siemplify.get_cases_by_filter" method, I observed the following:siemplify.get_cases_by_filter(statuses=[2]) give me CLOSED cases and  siemplify.get_cases_by_filter(statuses=[1])  gives me OPEN caseswhich is directly in contradiction with the 'SiemplifyDataModel.ApiSyncCaseStatusEnum' model which states:ALL= 2CLOSED= 1CREATION_PENDING= 4MERGED= 3OPENED= 0Am I doing something wrong. Any insight would be appreciated!Regards,Abhro Roy

We have setup our Secops instance to ingest GCP logs using doc : https://cloud.google.com/chronicle/docs/ingestion/cloud/ingest-gcp-logs. But seems like this integration does not ingest VPC change logs. We need to get all the VPC change logs from Google Cloud to SecOps. Can anyone help with what we need to ingest these logs firsts and how will the SIEM rule for this look like.Thanks

Hello folks, I have been getting an 'internal error' from the chronicle siem feed creation to collect Azure AD Logs. I have tested the credentials required for the connection with postman - and works perfectly.I don't know why the chronicle feed is throwing this error, could anyone please help ?

Hello,I'm encountering a recurring issue when using Google SOAR, and I hope the community and Google team can assist.From time to time, I experience the SOAR interface getting stuck, particularly on the login page or on pages like "Settings" or "Playbooks." It consistently happens when I'm using Google Chrome browser—including in incognito mode.Whenever this issue arises, I switch to Firefox, where everything works smoothly without interruptions.Issue occurs intermittently, mostly in Google Chrome.Happens even in Incognito Mode.Switching to Firefox temporarily resolves the issue.Has anyone else experienced this? I would appreciate any suggestions or solutions. Thank you!

New content is constantly being added to MSV as new malware, attack methods, etc. are discovered by Google.  As such, customers would like to be able to quickly get information on the new content without having to go to the library and filter down to the new actions.  This code will pull all of the actions added to MSV since a specific date.  The code looks at a JSON file to get the start date information.  This could easily be replaced with a variable passed into the method.   Enjoy! def getNewActions():#Read the config file - config file must be prebuilt#Read the list of content imports#Update the config file with the latest runtime#Search the content imports list to see if there is new content#Make a list of new content if it is available#Return the list or an empty list if no new content is available     newStuff = False     newActions = {}     f = open('data.json')     configuration = json.lo

One of the most common questions I hear about MSV is why an event isn’t being attributed to an action being executed.  I normally go through the following steps to see if we can determine why the event wasn’t attributed: Does the event exist at all? (Seriously.)  Is there an event in the security technology that we are integrated with that matches the action that we ran. Is the time good for the event?  Every action executed in MSV has a start time and end time.  The event in question needs to occur between those two times. For example, _time is used in Splunk to denote the time of an event. If _time isn’t between the start time and end time, we will generally not match it to an action. Does the event have correct information?  Is the source IP, destination IP, and/or hostname correct?  Sometimes security technologies put a default (not null) value for a field when it hasn’t been explicitly assigned, and that can cause MSV to not match. Does the event sho

MA-SV Users, The Mandiant Security Validation Team will be deploying 5.14.1.0 on Tuesday, October 1, 2024 at 0800 EDT (12:00PM UTC). During this time, users might experience brief disruptions accessing the service. Full service will be restored no later than 9:00AM EDT (1:00PM UTC).Fixes include: Fixed an issue where testing queries returned "null" in results without indication of error. Fixed an issue where the AEDA landing page didn't indicate that monitors were broken. Fixed an issue where the Operation Status incorrectly stated that Remote Integration tests were failing. Fixed an issue where Jobs indefinitely stalled in between groups. Fixed an issue where the AEDA landing page was taking too long to update. Fixed an issue where the LoginUI.exe process took too long to restart when a Network Action was run with an interactive session using a Windows system as the source Actor. Fixed an issue where scheduled Jobs couldn't be edited. Fixed an issue where AWS MSI integratio