This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Hey there,I'm posting this hoping to find answers (and possibily a
solution): In the last weeks I've been trying to upload IOC domains to
SecOps using the method described here
(https://medium.com/@thatsiemguy/ioc-matching-in-chronicle-siem-45a97c0b9...
Thanks for your feedback.Alright, I'm now uploading one IP address per
event and still, my rule is not matching whereas the IOC MATCHES page
is. What am I doing wrong?
How do I do that? This is my rule:rule test_ioc_ip_matching { meta:
description = "Test harness for matching IOCs via Entity Graph" events:
$e.metadata.event_type = "NETWORK_CONNECTION" $e.principal.ip = $asset
$e.target.ip = $ip $ioc.graph.metadata....
That seems to have done the trick, Thanks!However, my IP addresses
aren't always matched in my rules. Do you know if there are any limits
to the amount of IOC uploaded per requests or per entity (aside from the
1MB request size limit)? Reading the do...
Hello,Here's the full json payload I'm uploading with sensitive data
masked:{"customer_id": "CUSTOMER_ID","entities": [{"entity": {"domain":
{"name": "test.com"},"hostname": "test.com"},"metadata":
{"collected_timestamp":
"2024-09-26T06:52:55.013351+...
