This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Hi,I'm trying to query our SecOps SIEM tenant to extract some data that
is beyond the limits of the GUI. However, I'm running into problems
which seem to be due to changes in the API. The published documentation
refers to the backstory API, but our S...
I have a question about the Entity Graph, and specifically whether I can
customise it and use it for non-default purposes? Here is a simple use
case I’d like to know if it’s possible and if so how I can go about
it.We log information about customer a...
Thanks, I also just found the secops-wrapper which looks perfect for my
needs so i'll give that a go.Its a weird situation, because it was
actually our Google team who provided the backstory scripts but said it
would need my own SA and key to work, w...
We are Ent+, but i'm not looking to query BigQuery, but Chronicle SIEM
via the API itself. This appears to be the new API, but it's not clear
to me (as a non-API dev) how to turn the scripts provided for querying
Backstory into valid scripts for the ...
Thanks for this, really useful. I've managed to get this working in a
test env, but our GCP team want the steps converted to Terraform for
deployment. I don't suppose you or anyone has examples of getting this
going with Terraform, and if there are s...
Oh, its not a problem with the feed. I just have a log source that
sometimes sends duplicates (via syslog). I think this is due to the way
it reads from the file and/or some artifact of the HA setup it's running
that causes the duplication. While I w...
Hi, how/where can we test/implement this feature? I have one log source
that is randomly duplicating logs (same timestamp, etc) Assuming we
cannot solve this at source, I would like it solved prior to alert
generation. Is this possible currently?
