Hello, community,
Today I'm facing something weird and can't figure out how this is possible...
I've implemented a custom detection rule on my Chronicle SIEM instance that detects when a particular user deletes more than 20 files over 10 seconds. To test the rule I've deleted 26 files.
On the SIEM side the rule correctly detects file deletion events and raises an alert grouping all 26 file deletions.
On the SOAR side I correctly received a new case with an alert but inside the alert, I can see 120 events... Looking at these events I can find a lot of duplicates...
I can't figure out why this strange behavior. The Chronicle connector has been configured from a while and with other alerts works fine pulling the correct number of events.
What I'm missing?
Thank you!
A
LinkedIn
Twitter
