About dlove40

dlove40 · 01-13-2025

We, at Foresite, ran into a SecOps authentication error with some instances we support after the recent January 11th SecOps release. https://cloud.google.com/chronicle/docs/secops/release-notes#January_11_2025The change affected how IDP group names a...

dlove40

You can use a SOAR remote agent. The remote agent is used by SecOps to communicate to on prem resources like Windows Active Directory. https://cloud.google.com/chronicle/docs/soar/working-with-remote-agents/what-is-a-remote-agent

dlove40 · 04-29-2025

The chronicle cli has a command to list errors. https://cloud.google.com/chronicle/docs/administration/cli-user-guide#list_errors_argument The old CBN CLI tool does as well.https://github.com/chronicle/cbn-tool

dlove40 · 03-26-2025

I could put a 1 hour virtual class together. What SecOps topics are you wanting to cover?

dlove40 · 02-06-2025

filter { mutate { replace => { "event_type" => "GENERIC_EVENT" "severity" => "INFO" } } # Security Result if [severity] == "INFO" { mutate { replace => { "description" => "SUCCESS" } } mutate { replace => { "security_action" => "ALLOW" "security_resu...

dlove40 · 02-04-2025

You have to put the entire parser in your looping logic so it creates a UDM event for each event in your array.

My Stats

Aanchal_kumari's Bio

Badges dlove40 Earned

Recent Activity

SecOps Authentication Error and Solution

Re: On-Prem Active Directory Integration using API connectivity

Re: How to view raw logs that have failed to parse?

Re: Does Google have sec ops trainings, focusing only on sec ops and not the many other products?

Re: 'panic encountered: non-string given for securityresult.description'

Re: How to parse json array in Chronicle SIEM