This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Hi all, I'm in process of ingesting Office 365 feed into chronicle SIEM.
I would like to know if there is guidance on how to configure apps on
Azure side. Chronicle doc page forward people on Microsoft doc, Office
365 Management APIs , Microsoft expl...
Hi, I would like to know to if there is way to append a reference list
without getting the content of the list before? I look at
https://cloud.google.com/chronicle/docs/reference/reference-lists-api#updatereferencelist
and the UpdateReferenceList see...
Hi, I would like to know how other security team use the IOC matches
alerts. Where I work, we are using the IOC matches without other IOC
feed than the default feed(US DHS AIS, ESET threat intel and Open Source
Intel). Team members are complaining ab...
Hi all, I'm working on tuning that yaral rules
gcp_cloudaudit/gcp_dns_modification.yaral from the github repo. When I
look at detection vs rules languages, the udm fields
target.user.email_addresses isn't present in our procedural filtering.
the udm ...
@jstoner I may have another question about configuring azure apps. This
time more precise. In the api permissions, we have the choices of 2
permissions (delegated permissions or Applications permissions). Based
on Microsoft docs, Application Permissi...
https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsersSupported
log types with a default parserSupported log types without a default
parser
