About jstoner

jstoner

Last year, Google Security Operations added the pivot capability to aggregate and calculate statistics in UDM search. This allowed users the ability to take a UDM search and use an interface to aggregate values, like this. Fast forward to this year, ...

jstoner

Today we are going to review the third type of reference list that we can use in our YARA-L rules in Google SecOps. This one is focused on regular expressions. Regex reference lists provide additional flexibility because they are not limited to direc...

jstoner

"New to Google SecOps" is a deep-dive series by Google Cloud Principal Security Strategist John Stoner which provides practical guidance for security teams that are either new to Security Operations Platforms or replacing their Security Operations Pl...

jstoner

New to Google SecOps" is a deep-dive series by Google Cloud Principal Security Strategist John Stoner which provides practical guidance for security teams that are either new to Security Operations Platforms or replacing their Security Operations Pla...

jstoner

"New to Google SecOps" is a deep-dive series by Google Cloud Principal Security Strategist John Stoner which provides practical guidance for security teams that are either new to Security Operations Platforms or replacing their Security Operations Pl...

jstoner

I’ve played with it previously but not recently. At one point it was outputting alerts via the graph api alert. This would be set up via feed management like other o365 and entra id logging

jstoner

Your statement about gathering like fields in a placeholder is exactly what it is designed for. Match does what it does so this is designed to gather so match can aggregate like values. in the example above all 1.1.1.1 from principal and target are s...

jstoner

This is a really good question and hopefully I can help you out here. In search, we have the concept of grouped fields. When we search for IP = 1.1.1.1 for example, we end up searching a number of different IP fields including principal, target, obse...

jstoner

In the early examples I showed, I was really focused on the metric construction and what you could see based on adding metrics to rules. I believe I had a few rule examples where the rubber hit the road but not for every metric. Here's an example rul...

jstoner

I think this link is the one that does the best to explain the API permissions that need to be configured in the app to gain access to the relevant data streams. I've used this with Chronicle and with Splunk previously and it seems to work fine. Once...

My Stats

gamini_gowda's Bio

Badges jstoner Earned

Recent Activity

New to Google SecOps: Introducing Statistical Search

Getting to Know Google SecOps: Regex Reference Lists

New to Google SecOps: Formatting, Filtering and Sharing Dashboards

New to Google SecOps: Building Dashboards Using Custom Fields

New to Google SecOps: Dashboarding - Using Pivot to Create a Time Chart

Re: How can we integrate Microsoft Defender for O365 with Chronicle SIEM ?

Re: What is the utility of a group function in YARA-L?

Re: What is the utility of a group function in YARA-L?

Re: metrics - data is being bucketed on a daily basis across a window of 30 days.

Re: Office 365 apps configuration