UDM Querry Function for Chronicle

[mccrilb]

I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.

[mccrilb]

It looks like that our system had an issue. Shortly after I posted this we needed to have a reboot. After the reboot not only does nocase work, but so does regex.

We added this to our phishing playbooks. We take the sender, regex the subject and return all users (this includes the BCC) that received the email. We use the output to search exchange and move all copies of the email to the users deleted folder

[shakedtal]

Thank you so much for sharing @mccrilb 🙏