Security Forums

hello  is there a way to get free trial of chronicle siem and soar for evaluation ?

I have an existing parser that is working fine, but doesn't contain UDM mappings for a few RAW fields. This is actually a custom parser that was 'cloned' from the prebuilt/default version (which is now disabled).I need to leave the prebuilt/default parser alone even though it's disabled (for support/warranty reasons). And as we're already using a customer parser, I can't create another clone - Chronicle seems to be limited to 1 custom parser per data type.My options for adding these field mappings seem to be:1) Modify the customer parser2) Create a parser extensionWhat are the pros and cons of each method? I need to be cautious as the custom parser is in use 24/7.

In the following doc:https://cloud.google.com/chronicle/docs/reference/udm-field-listit says:> When writing configuration-based normalizer (CBN) parsers, use the <prefix> pattern event.idm.read_only_udm for UDM Event fields and event.idm.graph for UDM Entity fields. I am very confused. What does `idm`, `read_only_udm`, and `graph` mean here?  

Hello!I am trying to understand the statedump of a for loop.Raw log in JSON:    { "data":{ "businessPhones":[ "(123) 234-2320", "(123) 234-2321" ] } }      Parser:    filter { json { source => "message" array_function => "split_columns" } for phoneNumber in businessPhones { mutate { merge => { "user.phone_numbers" => "phoneNumber" } } } statedump {} }       Statedump:    Internal State (label=): { "@createTimestamp": { "nanos": 0, "seconds": 1708923328 }, "@enableCbnForLoop": true, "@onErrorCount"

Hi I'm trying to append a new label into the "event.idm.read_only_udm.target.resource.attribute.labels" field in the event.But when I try =>  creating a new label and merging it with the above event overwrites the values itself, dont append to it.Below is the code snippet:filter {json {source => "message"array_function => "split_columns"} grok {match => {"textPayload" => ['%{TIMESTAMP_ISO8601:istio_timestamp}\\] \\\\"%{WORD:method} (?:%{URIPATH:uri_path}(?:%{URIPARAM:uri_param})?|%{DATA}

Hello,I'm looking into possible solutions to have a use case as if the playbook attached to case, and that plb is failed in any node, blocks on execution, can get alert of notification or something similar on that. i.e. System, User Notification, small playbook which directly attached to all the open cases along with if they have playbook's execution, check if the primarily playbook execution been failed in somewhere. etc. Possible Solution: Jobs (similar to action monitor), Playbooks, Notification etc. Thank you.

Hi, Does anyone have a sample rule example for detecting WMIC Suspicious Scheduled Tasks and WMIC File Download? I am looking for both Scheduled Task and File Download. My search of Github did not fectch me any results unfortunately. 

Hello Team,Not able to parser the required fields from the oracle database audit logs.Sample log - <13>1 20**-0*-**T14:51:00+05:30 md****1 journal 3491695 - [meta sequenceId="2"] Oracle Audit[3491695]: LENGTH : '240' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294**7295' USERHOST:[7] 'md****1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Not able to parser fields ACTION, DATABASE USER. etc We are getting Grok error, so we took the field DATABASE USER, and wrote grok for the particular field, refering the default parser, but still getting grok error. grok {match => {"message" => [".*DATABASE\\sUSER:(?<DATABASE_USER>.*)\\sPRIVILEGE.*"]}overwrite => ["DATABASE_USER"]on_error => "grok_dbuser_fail"}if [DATABASE_USER] not in ["",

I have multiple firewalls (same log type) sending logs to a single collector and I need to identify them by their IP addresses. Is there a way to do this neither having to create and label hundreds of collectors nor requiring manual maintenance (e.g., using rsyslog would require editing it's config file every time a new log source is added)?

Hello,I want to use chronicle SIEM to monitor cloud storage, so I can be alert in things like:High volume of data downloads, e.g. over a certain threshold of data.High number of files.Downloads from unusual IP addresses or IP addresses other than a few known ones.New identity/account downloading data.I checked the docs and the Cloud Audit Logs parser supports sources does not include Cloud Storage data access and field mapping references I can't find  storage.objects.get. Does it mean that by default this logs are not supported.Can you provide some ideas about what will be required to start monitoring cloud storage data access logs with Chronicle SIEM?

Hi Team,We are using Wazuh agent in some of our endpoint and using Chronicle forwarder to ingest those logs in to the Chronicle instance. Everything is working fine, however, we are noticing those logs are truncated at 8194 character (there are few that reach the limit). This is causing the parsers to fail - as the overall log is now not a JSON body. How can we increase the character limit.

Hi,We have a software product which writes logs to specific tables on Mysql DB on a Windows server, we need to forward those logs either directly to Chronicle or through forwarder, can anyone guide me how can i accomplish this?Thanks in advance

Attending RSAC 2024?   Join us at the upcoming Google Security Operations workshop, where we'll do a deep dive into Search capabilities. https://www.googlecloudcommunity.com/gc/Events/Community-amp-Learning-Workshop-RSAC/ev-p/732954  

 I have tested a date filter that imports the metadata.event_timestamp correctly when used in a custom parser.  I set the timezone in the date filter and the tz offset is applied to the time so that the metadata.event_timestamp is correct in Z time.When I test the same date filter when creating a parser extension,  the UDM output preview of the metadata.event_timestamp has the original time without the tz offset applied. Can a parser extension be used to overwrite event_timestamp? 

Hi everyone,A customer is requiring a certificate of sanitization as per NIST SP 800-88 guidelines. I've done some research on my own but, from the articles I read, it is a bit of a grey area and I have hit a wall. I'm aware that in the background, google, AWS, and Azure are all following NIST SP 800-88 when it comes to decommissioning storage media but this doesn't really help me in providing a certificate to the customer. The guidelines recommend cryptographic erasure and provide some guidance on generally how to verify cryptographic erasure which seems to be the right direction but I am still not confident on how compliant data sanitization is performed in the cloud.Does anyone have any experience with needing certificates of sanitization in the cloud that could help guide me in understanding the process? Any help is appreciated! 

I'm currently using the below to get all closed cases within our SOAR platform - https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get_cases_ids_by_filter This code below is returning "Action failed as JSON result exceeded maximum size 0MB". Am I using this wrong or am I missing further parameters? With the max results being set to 1000 by default i'm expecting the last 1000 case ID's that are closed. - closed_cases = siemplify.get_cases_ids_by_filter("CLOSE", sort_by="CLOSE_TIME")

There are a few situations where it would be useful to write data to the file system, but my experience is that the data will not persist for more than a few days. I've tried writing data within the integration folder, above the integration, to /var/lib/*, and so on...all without any luck. The data soon disappears.A specific example is the use of AWS Secret Manager. A credential file cannot be used because it will not persist. For now, using a parameter will suffice, but there are other uses for writing local data to support custom jobs/actions that need to track information between runs.Any ideas are appreciated. Thank you!

Hi Team,I have integrated O365 to chronicle SIEM and want to create a usecase for MFA activities. Specifically, if a user adds new device, deletes a device or deletes MFA then it should trigger alert.Can it be done using O365 los only or do I have to integrate Azure AD as well. is these any usecase available????

Hi guys, I have q question while setup chronicle.When checking ioc matehes log, I can check the feed information "MISP" Is chronicle already integrated with MISP?If i want to write a rule with MISP data, do i not need to do any additional MISP integration work?

am facing issue on Configure single sign-on (SSO) on edge browser and getting the below error.The list of SSO providers could not be loaded.Please assist me on this issue.

I can't downloaded chronicle, I have already registered for for free edition but still I can't even get a chronicle site Pls  I need help. Thank you 

Hi, If I want to send\\ receive emails to\\ from customers via a dedicated mailbox, what would be the best way to configure it? using the built-in SOAR email settings (customer configuration) or the exchange integration from the marketplace?

I have a doubt, I am making a playbook in which I use two actions (Get similar Case), in one of them I look at IPs and in another one I look at Users. The output of these actions is an array of case identifiers, how can I compare these 2 arrays to see if any of their elements match?

We have a Chronicle forwarder set up, and we plan to send logs to it. Logs will be sent over the internet, so we're looking to encrypt the syslog data coming from our servers (rsyslog for Linux, nxlog for Windows).How do we ensure that the Chronicle forwarder unencrypts those logs before sending them up to the cloud?

write a regex to capture value between @ and " for below string.[{\\"ActionType\\":\\"Forward\\",\\"Recipients\\":[\\"Katrina.Demon@whxyz.co.um\\"],\\"ForwardFlags\\":\\"None\\"}] which is whxyz.co.um in above string.  or help write a yara code for capturing the same.  I am trying below, but is it giving error. re.capture ($e.security_result.detection_fields.value, "\\["([^"]+)"\\]") = $Domain