About Tomtomfridman

Tomtomfridman · 09-11-2023

This post was originally sent by Shaked Tal Hi SecOps Community  I’m excited to share that our SecOps Community will have a new and improved home beginning September 25, 2023 , as part of the Google Cloud Community (GCC). My name is Shaked, your cur...

Tomtomfridman · 02-15-2023

This post was originally sent by Tom Fridman The future's so bright - gotta wear shades! How do we know the future? Well we don’t, but we do know that Chris Martin will be the first SIEM person to present the next SecOps Community office hour- and wh...

Tomtomfridman · 02-09-2023

This post was originally sent by Tom Fridman hi Oops you did it again! You've sent us your most beloved pop songs that together created the most amazing SecPops playlist of all time. A playlist like this will bring all the boys to the yard. It'll wak...

Tomtomfridman · 02-06-2023

This post was originally sent by Tom Fridman Tom the boy (this is how we call him in the office) is king of the Grandma test. Do you know this test? It's when you are sitting down for a family dinner and grandma asks you "explain to me again what it ...

Tomtomfridman · 02-02-2023

This post was originally sent by Tom Fridman As we continue to provide you with all the knowledge you need to navigate the Chronicle platform, we are now turning our attention to a very popular feature that you have asked about a lot- our next Office...

Tomtomfridman · 09-21-2023

This comment was originally sent by Shaked Tal Login to the SecOps Community -> you will have an option for "Try it out - SOAR Free Edition" in the tiles -> click on "Get here" -> Fill in the form and you will get access to the SOAR Free Edition

Tomtomfridman · 09-20-2023

This comment was originally sent by Shaked Tal Hi @Chris_B the new SecOps community will be live on Sep 25th. In the meantime you can set up a GCC account and it will then sync with your SecOps account once we migrate

Tomtomfridman · 05-18-2023

Hi @CitrenoDan , there are separate credentials for the SecOps community forum and the SOAR free edition. In order to get access to the free edition you need to fill in the form for Chronicle SOAR free edition .

Tomtomfridman · 05-04-2023

This comment was originally sent by Gal Polak Hi @Ilan_Goldschmid , Currently there isn't an out of the box solution for this workflow and it requires to build something by yourself at this time using the Reference List API - https://cloud.google.com...

Tomtomfridman · 05-04-2023

This comment was originally sent by Gal Polak Hi @FranSalcidos , All log sources are normalized to UTC in Chronicle, assuming correct timezones have been applied at the Forwarder level. You can use YARA-L time functions as follows to create an out of...

My Stats

Tomtomfridman's Bio

Badges Tomtomfridman Earned

Recent Activity

I’m excited to share that our SecOps Community will have a new and improved home beginning

Chronicle SIEM reference lists

Oops you did it again!

The Grandma test

Our next Office Hour addresses Chronicle SOAR Approval Links.

Re: Can I get a instance of SOAR platform for testing?

Re: I’m excited to share that our SecOps Community will have a new and improved home beginning

Re: How to create and join to the Chronicle Free Edition

Re: Is there a way for a chronicle rule to populate a list upon a hit?

Re: Is it possible to prepare a single use case with different correlation Yara-L rules