This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Hi Team,We are facing issue when logging the Standalone SOAR platform.
The error message reads "no healthy upstream" and We can see 503 error
code on the network tab. We have raised some support ticket. Wanted to
check if this is isolated to us only ...
Hi,What is the best way to field unparsed events ingested in SecOps SIEM
without it being a pain. I have so far been searching for raw log with
regex and using Procedural Filtering for individual log source until I
collect few hundreds and then try t...
Hi Team,We are utilizing Chronicle Feed to ingest Office 365 logs. We
have integrated Audit.AzureActiveDirectory, Audit.Exchange,
Audit.SharePoint, Audit.General, and DLP.All as the sources. We are
seeing duplicate entries of the authentication logs....
Hi Team,I am looking to get an alert if I miss a log from an endpoint
from a server. Since the ingestion API monitoring is not granular enough
to get this info, I planned to create a dedicated Yara-L rule for the
said server. The rule I had planned f...
Hi Team,Can anyone provide an insight on how can we create an alert if a
log source (Let's assume a principal.hostname) stops sending logs for 30
mins?
Hi @chrisproudley ,We are currently using the same method. However in an
MSSP environment where there are thousands of events ingested every few
seconds, finding the unparsed log is like searching for a needle in a
haystack.We have reached where a po...
Hi @Rene_Figueroa,As stated in the post, for my usecase the ingestion
API is not granular enough as it only goes as far as the source and not
the fields within the pulled data. Let me know if I am missing out on
the implementation
