Hi, My reading suggests otherwise but wanted to ask on here whether anyone had successfully managed to create a rule that looks up an external list i.e an external URL which holds a list of known Cobalt Strike IP addresses. My reading suggests this i...

Is there anyway of querying via a UDM search to find alerts that have triggered?Thanks

Hi all, I am having an issue with the error message in the title field and some help would be really appreciated. I have wrote a YARA-L rule in Chronicle which captures various matching powershell command and decodes the successful match using the st...