This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Has anyone from the community tried implementing the Recorded Future
Dashboard from the below link?
https://github.com/RecordedFuture-ProfessionalServices/gsecops-siem-integration/tree/main/dashboards
Do we need to follow any special special steps to...
I'm building a custom parser and below is a snippet for which I'm facing
a issue. This particular field is not always present in all events. It's
gives values as False or will not be available
altogether.JSON:"body{custom{security{blocked = "FALSE"}}...
We are having an application which is exposing it's findings in it's own
API, we have been provided with their endpoint URL and API token.I'm
unable to see any integration options available in SIEM/SOAR where we
can pull such data from the 3rd party ...
We have Remote agents already running for specific environments. We need
to share the existing agent between environments (i.e) Agent deployed
for Development environment with Testing Environment. Currently there is
no option to edit the existing age...
We have onboarded alerts from a 3rd party security product in SIEM. We
have a single detection rule which monitors those events and creates
cases in SOAR. By default the case name and severity is assigned as rule
name and severity (meta section) in t...
Hi @mikewilusz , I have already initialized the variable already in the
parser. We have few events without this field name itself and during
validation the parser build is failed with those events as examples.
Hi @AbdElHafez Many Thanks for the detailed post. We are getting alerts
from a external system and this particular part in json contains the
ip/hostname of the machines which are affected. It can range from 1 to
30+. So, we thought to map it to "targ...
Hi @alube @cbryant, Thanks for your kind inputs. I took the GROK
function approach and utilized URIPATH and regex to capture the required
values. if [info][data] != "" {grok {match => {"info.data" =>
"%{URIPATH:full_path}(?incident-[^/]+)"}on_error =...
