This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Here’s where you’ll find a buzzing community of Security professionals from around the world with one common mission: bringing their Security platforms to the next level.
Hello,I struggle with the outcome section for a rule i'm working on at
the moment. I looked in the documentation and on this forum but I could
not find any solution.The rule looks for a potential succesful
bruteforce. So I defined 2 events variables ...
Hello srijankafle,I have the same problem about the lack of alert
suppression/throttling feature in Chronicle SIEM. I'm not sure why this
is yet to be implemented since this is a very common feature among the
SIEM competitors. I think it is a much wa...
Hello jstoner,Thanks for the detailed answer !Sadly, none of the
solutions provided is acceptable regarding my orchestration
prerequisites being "one field containing only a list of user-agents"
(the orchestration process is already defined and this ...
Hey, thanks for the answer ! The problem with the above solution is that
it would tie the two event variables together over the same $useragent
value.Therefore, from my understanding, the rule would not trigger if
$success has a different value for $...
