[Quick Tip] How to share information between playbooks
Sometimes, you might be in a situation, where you want to share information between multiple playbooks, even a...
SecOps SOAR
This is the place to discuss all things related to SOAR, including best practices, tools, and use cases. We encourage you to ask questions, share your knowledge and experience with the community.
Forum Posts
[Important] New Platform Feature - Custom Fields
This week we released Custom Fields - a new Case Management feature that allows you to extend the cases and al...
Leverage GenAI in automation with Vertex AI integration
We just released a new integration - Vertex AI! It's in public preview. If you are not familiar with Vertex AI...
Upgrade to Python 3.11 for the latest security and functionality updates
Hello Google SecOps Users, On July 14, 2024, Python 3.11 with migration best practices was made available in G...
Matching of IP-entities against a list of CIDR address
Hi Community, I just tried importing a subnet list (Settings -> Environments -> Networks) with ~1450 lines, bu...
Switching from "Okta" to "custom SAML provider
I tried switching from "Okta" to "custom SAML provider" this morning, but Siemplify gave me an error "there wa...
Alerts grouping
Quick question community. On the alerts grouping. The grouping time starts the moment a case is created and ha...
Jinja templating
Hi All, Just wondering if there are any Jinja gurus about, i seem to be having a daft issue with my Jinja temp...
Criteria you use to assign priority
Hi All, The SOAR cases have a priority (informative, low, medium, high, critical), what is the criteria you us...
How to create this custom action
Hello fam, got a question for ya'll: Suppose I have an alert that contains an entry like device=xyz Suppose I ...
Differentiating between Group entities and source grouping identifiers
Hello everyone, Please can someone elaborate on this, differentiating between Group entities and source groupi...
Are there any guides for the TemplateEngine integration?
Hey all, Are there any guides for the TemplateEngine integration (Specifically for the Entity Insight action?)...
Experience in implementing MITRE ATT&CK on playbooks
Hi community, anyone has experience in implementing MITRE ATT&CK on playbooks, I want to implement it but I do...
Search for a sub-string in a string
Hi when using the Filter in the expression builder is it possible to search for a sub-string in a string? The ...
Search filters selection
Hi folks... taking advantage of the community questions support, because you're all so knowledgeable (Thanks i...
Poll a case for open alerts and close the case through a playbook action
Does anyone know if there is a way to poll a case for open alerts and then close the case if there aren't any ...
Playbook placeholders for internal users entity
there are playbook action placeholders for lots of entity types, but not for internal users. is there an easy ...
Change and Delete Ontology
Hello, everyone! I’m configuring my CSV connection, and I’ve changed the title of my CSV file multiple times, ...
Trouble setting up local CSV connector
Hi, Hello, I’m attempting to run a basic local case to test my playbook, but I’m having trouble setting up my ...
Entity Selection
Hello, Please I have a question on the entity selection, is there a way to display or use those entities selec...
Query Joiner
Hello, please can someone direct me on how the query joiner works? These are the screenshot below of what i tr...
Need help: Bridged Adapter doesn't work on Community OVA in VirtualBox
Hey community, I am new to siemplify, I just installed Community OVA in VirtualBox, chose Bridged Adapter, en0...
Unified Data Model?
Ok last question (for now). What is UDM (Unified Data Model)?
Security Command Center scan for projects that are deleted
Hi,When projects in GCP are in shut-down state, will Security Command Center remove all project-related vulner...
Getting started with Chronicle?
Is there any documentation on how to get started with Chronicle?
Getting colleagues access to Chronicle?
I have a new team member, how do I get them access to Chronicle?
AbuseCH Malware Bazaar Integration
Does anybody have an AbuseCH Malware Bazaar integration up and running yet? I am working on one and wondering ...
How the grouping of alerts happening if am using arcsight SIEM ?
I know the grouping based on the entities and the time frame. to be more precise which time will it consider f...
Endpoints
How or witch tool should I use to monitore por example seven endpoints at my local network
