Getting to Know Google SecOps: Reference List
Let's look at how we can use reference lists in our YARA-L rules in Google SecOps. Reference lists provide a s...
Chronicle Best Practices
Learn about Chronicle best practices and bring your security operations center to the next level. Share and discuss with Googlers and security practioners in the Chronicle Forums.
Knowledge Base Articles
Getting to Know Google SecOps: Functions: Network
Let's look at how we can use the CIDR network function or as it is called in YARA-L, net.ip_in_range_cidr, for...
Getting to Know Chronicle: Functions - strings.coalesce
Let's look at how we can use the string function coalesce or as it is called in YARA-L strings.coalesce, for u...
Getting to Know Chronicle: Functions - strings.concat
Let's look at how we can use the string function concatenation or as it is called in YARA-L strings.concat, fo...
Getting to Know Chronicle: Outcomes - Risk Score, Conditional Logic and Mathematical Operators
We are covering a lot of ground today, as we take a look at risk score, conditional logic and mathematical ope...
Getting to Know Chronicle: Outcomes in a Multi Event Rule - Max, Min, Sum
Today, we are going to cover the aggregation functions of min, max and sum and how they can be added to the ou...
Chronicle SIEM: Outcomes in Multi Event Rules: Arrays
Today, we are going to cover two aggregation functions that are often used with strings in the outcome section...
Getting to Know Chronicle: Outcomes in a Multi Event Rule - Counts
Today, we are going to introduce the ability to generate counts within the outcome section of a YARA-L rule in...
Getting to Know Chronicle: Introducing Outcomes in a Single Event Rule
Today, we are going to introduce the outcome section of a YARA-L rule and demonstrate how we can additional co...
Getting to Know Chronicle: Building a Multi Event Rule - Sliding Windows
Today, we are going to build a multi event rule in Chronicle SIEM, but this time we will use a sliding window ...
Getting to Know Chronicle: Building a Multi Event Rule - Multiple Joins and Counts in Conditions
In this post, we’re going to build a multi event rule in Chronicle SIEM with a focus on joining multiple field...
Getting to Know Chronicle: Building a Multi Event Rule - Ordering Events
In this post, we’re going to build a multi event rule in Chronicle SIEM with a focus on ordering events to tri...
Integrating Chrome Enterprise Management with Google Chronicle
In this post, I demonstrate how to integrate Chrome Enterprise Management with Google Chronicle to gain compre...
Getting to Know Chronicle: Building a Multi Event Rule - Joining Events
In this post, we’re going to build a multi event rule in Chronicle SIEM that can be used to join disparate eve...
Getting to Know Chronicle SIEM: Building a Single Event Rule - String Match
In this post, we’re going to build a single event rule in Chronicle SIEM using string matching, which will ser...
Getting to Know Chronicle SIEM: YARA-L Rule Options
In this post, we’re going to get to know Chronicle SIEM with a focus on the various options available in the r...
Getting to Know Chronicle SIEM: Rules Editor Navigation
In this post, we’re going to get to know Chronicle SIEM with a focus on navigating the Rules Editor, which wil...
Getting to Know Chronicle SIEM: Setting a threshold in conditions
In our previous post, we covered how Chronicle SIEM can aggregate events into a single detection and alert wit...
Getting to Know Chronicle SIEM: Aggregating events in rules
In our previous post, we covered building a single event rule in Chronicle SIEM using a regular expression. In...
Getting to Know Chronicle SIEM: Building a single event rule using a regular expression
In our previous post, we covered using event operators and modifiers that demonstrate the flexibility in build...
Getting to know Chronicle SIEM: YARA-L operators and modifiers
In our previous post, we covered an introduction to Chronicle SIEM with a focus on using variables in YARA-L t...
Getting to know Chronicle SIEM: YARA-L rule variables
In our previous post, we provided an introduction to Chronicle SIEM with a focus on YARA-L basics and how dete...
Getting to know Chronicle SIEM: YARA-L basics
YARA-L is a language used to create rules for searching through your enterprise log data (hence the “L”) as it...
Using advanced analytics for the insights of tomorrow
Today, most SOC managers and CISOs are using metrics to track the security posture and measure their SOC’s per...
Guide | Quick OVA Deployment And Portal Login
Hello everyone, I’ve seen various questions around the slack channel about the OVA deployment, so I’m writing ...
Noise Reduction- Cyrus Robinson, community domain expert
Have you ever noticed trees that are marked with spray paint? Now, I’m no tree spray paint marking expert, but...
Jason Crosby External IP Enrichment v2 Block
Our judges were impressed by the clever use of Siemplify technology and the logic behind his block. Jason Cros...
Cyrus Robinson 24/7 block
After you implement Dor's enrichment block, we want to introduce you to Cyrus's 24/7 block, which won 2nd plac...
CyberSixgill Enrichment Block for SE
As promised, we are sending you the winning blocks from the Community Challenge. So, we’ll start with the 3rd ...
How to Use Output from a Block as Input for Another Block
Someone asked this in the Siemplify Community Slack, so I thought it might be helpful to document it here as w...
