This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Hello,I'm trying to run a Google Cloud API query from the SOAR platform,
using the Integration.The error I'm getting is:"Failed to execute API
request.Reason: An error occurred: 400 Client Error: Bad Request for
url: https://logging.googleapis.com/v2...
Hi,I need to create a users' group that would only be granted access to
the SIEM parts of the SecOps instance or potentially, have the ability
to only also access a specific environment on the SOAR.I tried to follow
this guide, but the information th...
Hi,I'm trying to identify failed logins to our Linux servers and created
a detection rule for that. Different servers yield slightly different
messages that are stored in `metadata.description`. For example, one
server would yield the following value...
Hi,We've defined an AuditD Collector (10.0.0.47, UDP Port 517) in our
Forwarder and send from our Linux (Ubuntu) servers the auth and authpriv
logs to it: auth,authpriv.* @10.0.0.47:517 Using Ngrep, we can see that
the information is delivered to the...
Hi,I'm using a Cisco Router and when I set initially the forwarder to
include a CISCO_ROUTER forwarder, it provided very little information in
the UDM.I then I switched to a CISCO_VPN forwarder that didn't parse my
log entry at all and then when I tr...
Hi @ylandovskyy ,Thanks for getting back to me.The Cloud Logging
Integration, as other existing Google Cloud integrations on the
marketplace are specific and can be used in particular cases, but I want
to be able to run any Google Cloud API query, ju...
Hi @DanDye Following your comments, I reviewed the "IAM Role Mapping"
page in the SOAR settings, and found 2 things that seemed to affect the
unwanted behaviour:1. There was a role called "ChronicleSOAR Admin" that
was assigned to Administrators and ...
Yes. You are right, @DanDye Should I switch to "Workforce Identity
Federation"?Seems the "Google Cloud Identity" isn't mature enough and is
full of bugs
Hi @ajohnson Thanks for your guidance on this.To address your
comments:1. The SIEM only role doesn't have any additional roles
accesses2. I sent to the support the HAR (I have a case open for more
than a month). No actual assistance from them.I'm thi...
Adding that I compared my platform with a partner and under SOAR
Settings >>Advanced, they have "IDP GROUP Mapping", while we have "IAM
Role Mapping". Theirs works and ours doesn't. I suspect now that this is
the cause of the issue
