Security Forums

Hello Everyone, VMware has announced VMware Carbon Black Cloud Alerts v6 API deprecation with a official deactivation date of version 6 of the API on July 31, 2024. This will affect The Chronicle SOAR VMware Carbon Black Cloud integration, specifically  * Dismiss VMware Carbon Black Cloud Alert Action* VMware Carbon Black Cloud Alerts Connector* VMware Carbon Black Cloud Alerts and Events Baseline Connector* VMware Carbon Black Cloud Alerts and Events Tracking Connector We have already released an updated version of th

After an Issue has been seen in a scan it will show in the collection settings. Only after that, an Issue can be disabled. Right now we are not able to turn off checks that have not been seen for that Collection. You can find the configuration under the Collection Settings.  

For Collections configured with high number of seeds and resulting in many entities, there will be a big number of scans to be initiated by ASM. This means that WAF rate-limiting might kick in and stop some of these scans coming from the ASM ranges. The library in the UI will show you all the tasks that are ran. They are not run all on every entity, but depending on entity type and number of entities behind the WAF it is possible to hit 30k or more scans. ASM also has over 100 ports that are being scannned, IPv4 for by default. ASM Customers can also add custom ports that may add to events seen.

By default, Mandiant ASM (Attack Surface Management) has a focused approach to identifying assets for testing. This is great for minimizing false positives, but penetration testers who want a wider net can enable "broad scoping." While this feature helps uncover more potential targets, it might also lead to some inaccuracies in asset ownership identification due to the broader DNS entity scoping. The above can be found here: https://docs.mandiant.com/home/asm-collections-overview Enabling broad scoping:  

Is there a way to run a SIEM search on rules so I can report out rules by name, status, last updated, updated by, rule text? Hoping to do this for SOPs and auditing rule changes.I've looked for rule strings in UDM raw search and do not find anything.If I manage my SIEM rules via GitHub I  can do this from there.Any thoughts or is report editing simply not logged?

Dear Community,Did anyone manage to successfully transform or parse Windows Event Logs (System, Security) that are coming from a Snare Agent such that they can be correctly parsed with one of the default parsers, such as WINEVTLOG?We currently have a situation where Snare is already rolled out to ~5000 Windows servers and it would be awesome to utilize the existing setup.Snare supports a couple of log formats (SNARE, SYSLOG (RFC3164), etc.).Here is a log sample with the format SYSLOG (RFC3164):<14>May 06 19:12:14 dc01.test.internal MSWinEventLog    6    Security    17349    Mon May 06 19:12:13 2024    4624    Microsoft-Windows-Security-Auditing    TEST.INTERNAL\\DC01$    N/A    Success Audit    DC01.test.internal&nbs

In this brief post, we'll take a closer look at the Library in Attack Surface Management (ASM). In ASM you have the ability to browse a listing of all available Issue Definitions, Technology Definitions, and Task Definitions.  This can be useful if you're interested in reviewing the various checks that ASM performs while scanning or the various technologies that ASM can identify.   The ASM Library can be accessed via the following URL, or by clicking your profile drop-down menu in ASM and selecting Library. https://asm.advantage.mandiant.com/library/ On the Library page, we can see that the library is composed of the same three definition types mentioned above, and that we can click through these to browse through

I think we all know that pilots have a rigorous set of checks to complete before they take off in their plane. They are mainly safety checks to ensure that the plane can take off and land safely. The Advanced Environmental Drift Analysis module (AEDA) in the Mandiant Security Validation platform can be used similarly to ensure that the security control ecosystem can perform its core functions of protecting data assets.   A Quick Primer for AEDA.   The Advanced Environmental Drift Analysis module is designed to schedule attack simulations at predefined intervals targeting specific security controls where an expected “known good” response has already been determined. This predetermined response is best determined using the Effectiveness Validation process when onboarding MSV. This process addresses security control telemetry visibility and e

Do we have documented exclusions for MacOS endpoint actors? I did not see anything in the documentation. I'm using "exclusions" as my search term. Thanks in advance for the guidance.

I have created a project and was wondering how I delete it?

This guide will use Python to connect to ASM via API to create and/or delete. The script will contain a menu with 3 options List current projects and project ID Create New Project Delete Project Step 1: Import "request" Module & Create Main Function     import requests def main(): try: # Input API key and Secret via api_credentials.json file with open('api_credentials.json', 'r') as file: credentials = json.load(file) api_key = credentials.get('api_key') api_secret = credentials.get('api_secret') except FileNotFoundError: # Error message if api_credentials.json file is not found print("Error: api_credentials.json not found.") exit(1) except json.JSONDecodeError: # Error message if api_credentials.json is not formated correctly print("Error: Unable to parse api_credentials.json.") exit(1)    

Hi Team,Could someone please clarify the exact meaning of the "Parsing error" and "Validation error" in the Data Ingestion and Health dashboard?Thanks,Manoj  

Hi,Hoping someone can help me.Do google provide any documents related to pen testing, assurance, certification achievement/assignment, to demonstrate their products follow a secure development lifecycle and are safe and secure for use? Similar to the Microsoft trust portal?Thanks, Ben.

This is a quick overview of how to review findings sourced by Attack Surface Management (ASM) in Security Command Center Enterprise (SCCE). First, let's see ASM findings in the greater context of all other SCCE data sources.  From the SCCE navigation window on the left, select Sources.  The resulting screen will list SCCE findings by data source.  By scrolling down, we can see that Attack Surface Management is one of the available data sources, and that there are associated findings that ASM has returned.  Clicking one of these findings will redirect you to the associated entry under Findings. Another way to review findings from ASM in SCCE is to use the available filters w

The following two examples can be used as a reference for basic calls to the ASM API.   In both examples, the keys are fabricated and shown for the purpose of demonstrating how to correctly set the headers for each call.     curl https://asm-api.advantage.mandiant.com/api/v1/projects -H 'INTRIGUE_ACCESS_KEY: myaccesskey' -H 'INTRIGUE_SECRET_KEY: mysecretkey'     Invoke-WebRequest http://asm-api.advantage.mandiant.com/api/v1/projects -Headers @{'INTRIGUE_ACCESS_KEY' = 'myaccesskey'; 'INTRIGUE_SECRET_KEY' = 'mysecretkey'} -UseBasicParsing          

Hi Everyone,A common issue I have been facing is how can I provide UDM fields in the automated messages in my SOAR playbooks. The current way is to type out the UDM field and use the Placeholder variable to select which fields you want to select. ie)principal.ip="[Event.event_principal_ip]"Which can take quite a bit of time, especially if you want to enter +10 UDM fields!To remedy this I used the Render Template action to create a JINJA2 script that would perform the conversion automatically and format it so it can be copy/pasted directly into a UDM search for further investigation. Here is the script(be sure to select the "Include Case Data" check box):{% set CaseData = input_json['SiemplifyEvents'] %} {% if CaseData is defined %}    {% for event in CaseData %}        {% for item

Is there any way to set one view based on two different playbooks? One playbook is general and enrich data from Chronicle SIEM and similar cases, etc. The other one is more drill down based on the alert (EDR, MAIL, etc).I want a main view page that will present widgets from these two playbooks.

Can someone help me!? What we have done:We created a custom action(Prompt) that takes values from the analyst, so that the value can be used as input at some point in the playbook with the use of placeholders.What we are trying to achieve:Right now as the analyst is giving value to the prompt manually, we want to make case entities available for our custom action in the dropdown list like in the below image. So analysts can select one of the entities from the case, rather than giving it manually. This will save time to the analysts.Please let me know how can we add this kind of entities dropdown list to the custom actions.@TonyH 

Dear All,Could anyone please give me the script for ingestion UDM events directly to Chronicle via an Ingestion API and also to send a local file via ingestion API.Thank you in advance.Best Regards,Aravind S

Hi Guys,I am trying to creating a playbook with slack integration to send interactive messages to a channel. For sending the data i am using slack blocks (To build the blocks i have used slack block kit builder). But i am getting below error.OutcomeMessage was not sent because of occurred error: Invalid blocks formatAction Details:Slack - send Advanced Messageparameters:Message Type: BlocksRecipient Type: Channel or User IDRecipient: channel name (pfs)I was wondering if anyone in the community has encountered a similar issue in the past and could offer some guidance or insight on how to resolve it. Any help or advice would be greatly app

Hi All,I wanted to know if we can embed chronicle SIEM data source to Google Looker so that it helps us to create dashboards and reports in chronicle SIEM.Thanks,Neha.H

Hi Team,I wanted to know, how to embed chronicle SIEM data source to Google Looker & Looker Studio so that it helps us to create Custom dashboards and reports in chronicle SIEM and SOAR

We've introduced some great new capabilities to reCAPTCHA over the last 6 months including Fraud Intelligence Reports powered by Gemini, comprehensive dashboards through Looker Studio, payment fraud protection, Google Analytics integration, account defense for Mobile, and anomaly detection. Tons of great stuff. To learn more check out our blog!

Hi!I want to generate a rule that looks for the value of 'target.ip' field in a reference list.I have 3 reference lists:customer1_public_IPscustomer2_public_IPscustomer3_public_IPsIn my events, in the 'target.namespace' field comes the value of the customer (customer1 or customer2 or customer3).What I want to achieve in my rule is that depending on the value that the event has in the 'target.namespace field', one list or another is consulted.Something like the following:$e.target.ip in %($e.target.namespace)_public_IPsbut that doesn't work.The idea is to parameterize the query to the list and not to have to put a line for each customer because if in the future there are many more, it would not compensate to have to generate a line for each one of them.What would be the right way to do it? Thanks in advance.

Hi everyone, I need to migrate a SPL rule to Chronicle, can someone assit how this can be converted to YARA-L?| eval date=strftime(_time,"%d/%m/%Y") | eval date_dm=strftime(_time,"%d/%m")| eval date_wday=strftime(_time, "%w")The main goal would be to use these new fields in order to be able to search for events in a certain range of hours or days (for example in 2 p.m. and 6 p.m. or on Saturday between 3 p.m. and 8 p.m.).Thank you in advance for your help.Best regards