[Quick Tip] How to share information between playbooks
Sometimes, you might be in a situation, where you want to share information between multiple playbooks, even a...
SecOps SOAR
This is the place to discuss all things related to SOAR, including best practices, tools, and use cases. We encourage you to ask questions, share your knowledge and experience with the community.
Forum Posts
[Important] New Platform Feature - Custom Fields
This week we released Custom Fields - a new Case Management feature that allows you to extend the cases and al...
Leverage GenAI in automation with Vertex AI integration
We just released a new integration - Vertex AI! It's in public preview. If you are not familiar with Vertex AI...
Upgrade to Python 3.11 for the latest security and functionality updates
Hello Google SecOps Users, On July 14, 2024, Python 3.11 with migration best practices was made available in G...
How can we add a new log type? Do we have to contact google?
Hello everyone, we need to add the logs from a software that is still not supported in Chronicle, we will writ...
I have a question about search page result limit on chronicle?
I have a question about search page result limit on chronicle. Even I changed the time interval, I can just se...
Has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works?
Dear Community, Please, has anyone utilized the Re-Attach Playbook under Tools before and can explain how it w...
Forward OS Log to Chronicle
After I deploy Chronicle Forwarder on Linux or Windows. Does Chronicle Forwarder transmit my OS data to Chonic...
The article “How to Use GitSync” provides full details! - Access denied
Hi,I would like to read the article “How to Use GitSync” provides full details!" that was published in the new...
Is there any Information related to pricing for siem and soar?
Hello People is there any documentation related to pricing for siem and soar available or any contact to which...
Is there a way to control the number of simultaneous playbook runs per environment?
With current features, is there a way we can control number of simultaneous playbook runs per environment? For...
Do we have any community edition or such for testing the integration?
Hi Everyone, I'm in the process of installing forwarder and make it talk to Chronical SIEM. Do we have any com...
Can i use IDE in the community license?
Hi Everyone, I am using the Community edition and am trying to create a new custom connector. But looks like, ...
How to get slack access for SecOps Community?
Can anyone please send me the invite?Thanks
Activate chronicle using metadata file
Hey all,I have a new chronicle instance, how would i activate it using the metadata xml file? I lookedup on th...
chronicle Unified Data Model disk space
How much additional disk space UDM will take up?For example, if a UDM is generated after 1TB of raw logs are i...
How to get the Chronicle forwarder docker container running under linux?
Trying to get the Chronicle forwarder docker container running under linux and I'm getting this error: + /opt/...
Which resources for UDM parsing are apart from the official reference documentation?
Does anyone here know of any resources for UDM parsing apart from the official reference documentation? The do...
Is it possible to have an action that parses each entity on a playbook?
Hi everyone. I'm wondering if something is possible in a playbook. If I have an action that enriches a list of...
Is there a way to set additional data for a case in a similar way it can be set per alert?
Is there a way to set additional data for a case in a similar way it can be set per alert? I use siemplify.upd...
Having some issues with siemplify.update_entities(list_of_entities) method
Hi Team I am having some issues with A soar script. it seems to be happening when I call the siemplify.update_...
Does anyone have an idea on how to collect google workspace logs?
Trouble connecting to Google Workspace Hi, we created a connection to our Google Workspace account using the o...
Does anyone have a solution to easily run integrations in Pycharm or a debugger not within SOAR?
Does anyone have a wrapper or code sample to easily run integrations in Pycharm or a debugger not within SOAR?...
Hello, why was the page about webhook removed?
Hello, why was the page about webhook removed? https://cloud.google.com/chronicle/docs/preview/feed-management...
Is there a JSON function that we can get a count for certain field/group them by distinct values.
Is there a JSON function so that we can get a count for certain field and group them by distinct values. So th...
Is there a way to get Chronicle SIEM for our GCP instance without going through a 3rd party MSSP?
Is there a way to get Chronicle SIEM for our GCP instance without going through a 3rd party MSSP?
Is anybody else having problems not getting password reset emails from support.siemplify.co?
Is anybody else having problems not getting password reset emails from support.siemplify.co ?
Why is it when I duplicate a marketplace module script in the IDE it tweak some values?
Why is it when I duplicate a marketplace module script (library) in the IDE, give the duplicate object a name ...
I exported an integration made some changes and got an error while importing it
I tried a different approach and exported the CrowdStrike Marketplace integration, extracted the ZIP, made my ...
After registering to Chronicle SOAR trial edition can't manage to sign-in
Hi, I have registered for Chronicle SOAR Trial edition. After successful sign-in, the page hangs on login page...
Can anyone share more about the Chronicle incident going on at the moment?
Can anyone share more about the Chronicle incident going on at the moment? Does anyone have an inside track or...
Has anyone found a way to automate generating the token when it expires?
Exchange online integration, has anyone found a way to automate generating the token when it expires?
Has anyone maintained a customer integration that requires the TIPCommon module?
Has anyone maintained a customer integration that requires the TIPCommon module? If so, how did you add it? I'...
