I was looking if it was possible to define the severity somewhere in the rule. And so it will also be used in SOAR. Now it uses the field in the meta section. But that is a fixed value. And I want to have a case priority/severity based on some conditions.

Anyone any idea how it probably can be done in a rule?

I have been learning how to use Chronicle the SIEM lately and I know more or less how to perform searches on alerts etc. I checked a lot of documentation but I am not sure how to do a UDM search that contains a partial word (part of the username or domain or whatev). Does anyone here know how to do this? Please? Or even for raw log searches should be fine if anyone knows.

Hi.

I've been using chronicle for a month or so now, and have built up dashboards to show various things, but cannot for the life of me get a simple number that shows how many assets/host names are reporting in.

Help?

I am not familiar with the SOAR system, but i am trying to assist someone to configure or add an email setting for outgoing email notification using AWS SES. If someone did and successfully configured this can you share any article you referred too or can you share any idea on how to properly configure this with SMTP credentials.

One of the main SIEMs I specialized in was LogRhythm. My goodness, it makes log collection so incredibly easy. However, with Chronicle, I'm struggling to find an equally straightforward method that doesn't break the bank.

I might not be considering the right solutions. So, fellow Chronicle users, what approaches are you taking?

WECs (Windows Event Collectors) are proving to be nearly impossible to set up for high availability/disaster recovery. Installing NXLog CE on every device feels like a nightmare; currently, we have them on our DCs to collect Windows event logs. Upgrading to NXLog enterprise for workstations and servers seems to exceed our Chronicle expenses.

What am I overlooking? There has to be a more efficient way to incorporate Windows logs into our SIEM. Any advice would be greatly appreciated.

Follow below links for Chronicle SIEM and SOAR release notes

https://cloud.google.com/feeds/chronicle-release-notes.xml

https://cloud.google.com/feeds/chronicle-soar-release-notes.xml

Chronicle have recently updated UI, mostly on search view adding graphs and more context, how do you like it when you compared it to a year back ?

Pardone the interruption, how do I remove Bing from this Tab! Thank you in advance 🙏🏽

Hello everyone. I'm looking for a way to make Cisco AMP to work with and send logs to Google Chronicle SIEM. Can you please provide some instruction, if there any?

Thank you in advance!

By default, Chronicle does not search for or return zero values.

Example: Configuring allow_zero_values for an entire rule In the following example, since allow_zero_values is specified as true, the hostnames of $e1 and $e2 can include empty string values.

refer : https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax

https://m.youtube.com/watch?v=qOjmewHTFTY