About chrisd2

chrisd2

Hello,I struggle with the outcome section for a rule i'm working on at the moment. I looked in the documentation and on this forum but I could not find any solution.The rule looks for a potential succesful bruteforce. So I defined 2 events variables ...

chrisd2

Hello srijankafle,I have the same problem about the lack of alert suppression/throttling feature in Chronicle SIEM. I'm not sure why this is yet to be implemented since this is a very common feature among the SIEM competitors. I think it is a much wa...

chrisd2

Hello jstoner,Thanks for the detailed answer !Sadly, none of the solutions provided is acceptable regarding my orchestration prerequisites being "one field containing only a list of user-agents" (the orchestration process is already defined and this ...

chrisd2

Hey, thanks for the answer ! The problem with the above solution is that it would tie the two event variables together over the same $useragent value.Therefore, from my understanding, the rule would not trigger if $success has a different value for $...

My Stats

chrisd2's Bio

Badges chrisd2 Earned

Recent Activity

Problem with outcome aggregation (array) for a multiple-event rule

Re: Throttle Rule Alerts

Re: Problem with outcome aggregation (array) for a multiple-event rule

Re: Problem with outcome aggregation (array) for a multiple-event rule