Security Forums

Hello,I am looking for getting notification on Teams or Email if our analyst adds any comment to Case Wall.I already have Teams and Exchange integration, but not able to get any Action/Option/Feature on SecOps SOAR to send notification for comments added in Case Wall.Please help me with solution if anyone have.Thanks & Regards,Suraj Kadav

extract Example@ from Example@domain.com

HI everyoneIs there any chance that the webhook feed will be restored?Roberto

Hi ChroniclersI have a search with log_types, hostnames, users, serial#s.  I'm creating time buckets by minute using this:$date = strings.concat(timestamp.get_date(metadata.event_timestamp.seconds)," ", timestamp.get_hour(metadata.event_timestamp.seconds),":",timestamp.get_minute(metadata.event_timestamp.seconds),":00")In the stats aggregation search output  I want to group bymatch:$date, $logs, $host, $user, $serialand order by max(time) I'm struggling to do this.I also noticed when I use the pivot tab in SIEM search results, I get an error message that Pivot can't use metadata time in aggregation functions 😞(image)thoughts?   

Hi!I am a developer and I am looking for a captcha solution for my business. I would be curious to hear about a list of top 5 / 10 reasons why I should choose reCaptcha as my captcha solution, what are its advantages and pros that other captcha providers such as hCaptcha can't offer. Thanks.

How to automatically attach a playbook with trigger condition "ALL" to a manual case?i tested it doesnt works

Hi AllWhile i was going through this documentation (https://cloud.google.com/chronicle/docs/install/docker-forwarder-windows#runcfwindocker) i observed that the docker run command has a port number defined , however the same is not seen in linux . Can some one tell me what this  -p 10514:10514 ` means , is this port number of the different log sources mentioned in the collector ,Also when a new collector is added in Windows  will that port gets added in the docker as well ?Windows : docker run ` --name cfps ` --log-opt max-size=100m ` --log-opt max-file=10 ` -p 10514:10514 ` -v c:/opt/chronicle/config:c:/opt/chronicle/external ` -v c:/var/log/crowdstrike/falconhoseclient:c:/opt/chronicle/edr ` gcr.io/chronicle-container/cf_production_stableLinuxd

Hi Everyone,We are currently facing duplicate logs ingestion of offcice365, We figured this out by using metadata.product_log_id which should be unique  value while logging into the office365. This might be due to logs ingestion of past events while pulling logs from the office365.Is anyone in the community facing similar issue?

Hey team,Could you please share any info regarding the limitations for chronicle soar community edition instance. Wasn't able to get much details online in public domains. 

when we ingest alert in Soar it automatically get assigned to Tier-1 , can we make it to Unassigned basically assigned to no one  

It is very difficult to get along with SOAR. There is a lot of discrepancies in the documentation and to a large extent obsolete.It is very difficult to get by. So annoying.

Hi,Apologies if this has already been asked but i've scoured the forums to no avail. What currently is the schedule for data ingest into Looker - attempting to run reports for the past 24 hours / 7 days produces 0 events - so I think this might be on a weekly schedule. Given the power of the looker reports, is there a plan to make this more near real time?

Hi folks,I am developing a custom integration and have an action that takes a single IP address as an input and makes certain API calls and fetches detailed information about this IP.While integrating this action in a playbook, I noticed a use-case, that probably needs to be handled.Suppose, my action is a part of a playbook, that furthers gets run for a case, where I have multiple events. Each event in the case has a unique Source IP Address. In the action step in the playbook, the input parameter is passed as [Event.sourceAddress], then which event's IP Address would be considered ?Also, I assume IP address of only one of the many events will be considered, then what should I do to run this action for all the Source IP addresses of all the events in the case ?Hope the use-case is clear.Thanks.

Hey Team,Is it possible to create a clickable link in Incidents Comments / Instructions or Insights.For example also if you want to create a Link Back to the SIEM Alert / Event Details?

How can I choose a custom timepicker for dashboards. I am trying to create a report for a specific month but am unable to do so with dashboards as only the default options are available unlike in the cases window where I can specify a custom time range

Has anyone had any luck configuring their event mappings in SOAR for this integration?Seems every single event type could relate to a different named incident from Defender which makes this rather painful.With documentation thin on both sides (understandably), I can't help but feel some of us might be mucking through in silence.

Hello Community Members,To integrate Google Chronicle SOAR with on-premises QRadar, there is an out-of-the-box application available in the Marketplace. This application connector operates on a pull mechanism, meaning that the connector within Chronicle SOAR initiates requests to QRadar at defined intervals and pulls alerts into Chronicle SOAR.However, in my situation, the client restricts inbound connections to their on-premises QRadar SIEM, but they are open to having alerts pushed from QRadar to Chronicle SOAR. Can anyone suggest a solution to achieve this? Thanks in advance.

hey team! I've a little question about playbooks and loops. There's a process that has a multiple choice question for example if answer is no, I want to the "no" branch does a feedback and get back to a process before the multi choice question. I've tried just to move the previous process to the "no" branch but it can't be added to that branch. Do you have any idea?

Currently, I have developed an action in my custom integration and added logs using siemplify.LOGGER object. When tested the action under the Testing tab, I see the logs under Debug Output tab and all's good.But when I run the same action on any case from case wall, all I can see is the Output Message that was returned from the action. I could not find any way to look into the logs. The same case goes for the time when the action fails to execute successfully.Could anyone please guide me to the correct way to look at the logs for the actions.Thanks.

Hi Team,I have configured Ingestion Metric Dashboard. It was showing correct data till yesterday and suddenly it stated showing incorrect stats for ingested GB. No changes has been made in dashboard, I even tried creating new dashboard but still showing incorrect data.Anyone experienced this isssue recently. 

Hi All,Can we parse a log with the below mentioned format with out making any changes while ingesting?[ { "header": { "name": "EcoScope Data", "well": "35/12-6S", "field": "Fram", "date": "2022-06-14", "operator": "GeoSoft", "startIndex": 2907.79, "endIndex": 2907.84, "step": 0.01 }, "curves": [ { "name": "MD", "description": "Measured depth", "quantity": "length"

Hi all,When I am trying to fetch a month's ReCaptcha score, I see 2 options coming up:Assessment Request ScoresExecute Request Score ScoreI am confused about which one I should use to determine the ReCaptcha score for the month. Both the scores have slightly different values.Also, it would be helpful if someone could explain the difference between "Assessment Request Scores" and "Execute Request Scores." Some short descriptions for each would be helpful.

Hi Team,We are utilizing Chronicle Feed to ingest Office 365 logs. We have integrated Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, and DLP.All as the sources. We are seeing duplicate entries of the authentication logs. This was verified as logs with same raw log (all characters) and same value in metadata.product_log_id is repeated  2-3 times on average (up to 16 times) increasing false positives and data misrepresentation on the dashboard. Has someone discovered this issue and if yes is there any solution to this?

how can I onboard logs from two organizations into the chronicle?I have an organization that is currently set up native ingestion to chronicle, and everything is fine there. I have a requirement to send logs from a different organization now to the same chronicle instance, how can I do that?  

Hi Team,We have integrated AWS CloudTrail and AWS Guardduty with Chronicle Secops SIEM and our AWS S3 cost has been spiked.Is there a way we can reduce the cost (apart from creating new S3 bucket or limiting S3 bucket data) ?