About mccrilb

mccrilb

for example:AzureActivity| where Caller in (```user```)| where SubscriptionId == "subscriptionID"| where ResourceGroup in (```Resource Group```) Is there a way to do this now, or a feature in the works? We use KQL queries in "Execute a custom hunting...

mccrilb

This function no longer seems to be working correctly. We use this in several playbooks all of which are no longer functioning correctly.

mccrilb

This showed up in our SIEM today. I have been trying to figure this out. I can get it to work in a UDM search, but not in a rule.UDMprincipal.hostname in regex %CCF_SM_WINDOWS_Hack_Tools_CommandLine_Group1_Exclude.Hostname nocasetarget.process.file.f...

mccrilb · 04-03-2025

There is a major issue with this. I have opened a ticket.For the Add to Blacklist function:if the URL entity contains http or https the function does not remove the http or https and then validate and block the URL. Instead it parses out the domain a...

mccrilb · 03-20-2025

https://cloud.google.com/chronicle/docs/detection/rule-chaining?hl=en#single_event_detection_rulesHas anyone worked with this function? I did open a ticket, when I create the consumer rule I am seeing this errorparsing: error with token: "detection" ...

mccrilb

ok, thank you!

mccrilb

Anything on this? As of today, we are still not seeing this feature

mccrilb

Any update on this?

mccrilb

One use case that we have has to do with discovery. We have host discovery and AD discovery rules. Alone, they are noisy.

mccrilb

Thanks! I took a look and I think this will work!

My Stats

Yugali's Bio

Badges mccrilb Earned

Recent Activity

KQL Queries in Azure?

GoogleChronicle_Is Value In Reference List

Data Tables

ZScaler Integration

Rule chaining

Re: Rule chaining

Re: Rule chaining

Re: Rule chaining

Re: Rule chaining

Re: KQL Queries in Azure?